Hi @borisj,
Thank you for your detailed reply.
I could reproduce the same issue on my test site using latest version of BuddyPress Activity Plus plugin so i have notified the plugin developer to fix it in the plugin.
In the meanwhile to fix this issue you can make the below changes in the following BuddyPress Activity Plus plugin file on line number 39.
BuddyPress Activity Plus plugin file:
buddypress-activity-plus\lib\class_bpfb_codec.php
Before Editing:
return "[bpfb_link url='${url}' title='{$title}' image='{$image}']{$body}[/bpfb_link]";
After Editing:
return "[bpfb_link url='${url}' title='".esc_attr($title)."' image='{$image}']{$body}[/bpfb_link]";
Note: You are making changes in the plugin file and these changes will be overwritten and lost when you update the plugin and you will have to make these again after plugin updation.
Best Regards,
WPMU DEV