UP
Product
User Profile Builder
8
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 1High 4Medium 3Low 0
Watch
Add User Profile Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-15030 | 9.8 | Feb 2 | User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset Affected: 1.1.27 before 3.15.2 |
| CVE-2026-76548 | 8.2 | Aug 29 | Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass Affected: 3.8.1 before 4.0.1 |
| CVE-2026-15368 | 8.1 | Aug 1 | Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration Affected: before 3.16.4 |
| CVE-2026-111982 New | 7.2 | Oct 23 | Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change Affected: before 4.0.5 |
| CVE-2026-111948 | 7.1 | Oct 21 | Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions Affected: before 4.0.1 |
| CVE-2026-111966 New | 6.8 | Oct 23 | Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute Affected: before 4.0.5 |
| CVE-2026-76546 | 6.8 | Aug 29 | Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode Affected: 3.3.4 before 4.0.1 |
| CVE-2026-76547 | 6.6 | Aug 29 | Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export Affected: 3.3.4 before 4.0.1 |
Showing 8