Index: src/bp-settings/bp-settings-actions.php
===================================================================
--- src/bp-settings/bp-settings-actions.php	(revision 11690)
+++ src/bp-settings/bp-settings-actions.php	(working copy)
@@ -135,7 +135,7 @@
 
 		if ( !empty( $_POST['pass1'] ) && !empty( $_POST['pass2'] ) ) {
 
-			if ( ( $_POST['pass1'] == $_POST['pass2'] ) && !strpos( " " . $_POST['pass1'], "\\" ) ) {
+			if ( ( $_POST['pass1'] == $_POST['pass2'] ) && !strpos( " " . wp_unslash( $_POST['pass1'] ), "\\" ) ) {
 
 				// Password change attempt is successful.
 				if ( ( ! empty( $_POST['pwd'] ) && $_POST['pwd'] != $_POST['pass1'] ) || is_super_admin() )  {