What’s Vulnerable › Products
cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities
57 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 34 published in the last 12 months.
Latest cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities
- CVE-2026-54855 — WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-54854 — WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability (CVSS 6.3)
- CVE-2026-54853 — WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-115807 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute (CVSS 7.1)
- CVE-2026-111982 — Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change (CVSS 7.2)
- CVE-2026-111966 — Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute (CVSS 6.8)
- CVE-2026-112242 — WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability (CVSS 8.8)
- CVE-2026-111948 — Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions (CVSS 7.1)
- CVE-2026-109447 — User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] (CVSS 8.1)
- CVE-2026-107748 — User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter (CVSS 6.4)
- CVE-2026-100186 — User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field (CVSS 7.2)
- CVE-2026-96338 — WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-95866 — User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field (CVSS 7.2)
- CVE-2026-93656 — User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field (CVSS 6.4)
- CVE-2026-6431 — User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field (CVSS 7.2)
- CVE-2026-75964 — User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter (CVSS 6.1)
- CVE-2026-75965 — User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute (CVSS 6.4)
- CVE-2026-76548 — Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass (CVSS 8.2)
- CVE-2026-76547 — Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export (CVSS 6.6)
- CVE-2026-76546 — Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode (CVSS 6.8)
- CVE-2026-15826 — User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter (CVSS 9.8)
- CVE-2026-66701 — WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-15368 — Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration (CVSS 8.1)
- CVE-2026-42385 — WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-7647 — Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection (CVSS 8.1)