PB
Product
Profile Builder
26
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 3High 7Medium 16Low 0
Watch
Add Profile Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6695 | 9.8 | Jul 31 | it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions Affected: before 3.11.9 |
| CVE-2021-24527 | 9.8 | Aug 16 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain… Affected: before 3.4.9 |
| CVE-2024-6366 | 9.1 | Jul 29 | The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload… Affected: before 3.11.8 |
| CVE-2026-112242 New | 8.8 | Oct 22 | WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability Affected: through 4.0.4 |
| CVE-2024-22140 | 8.8 | Jan 31 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0 Affected: through 3.10.0 |
| CVE-2023-47669 | 8.8 | Nov 13 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.10.3 versions Affected: before 3.10.4 |
| CVE-2023-2297 | 8.1 | Apr 27 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0 Affected: through 3.9.0 |
| CVE-2024-0324 | 7.5 | Feb 5 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a… Affected: through 3.10.8 |
| CVE-2024-22141 | 7.5 | Jan 24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0 Affected: through 3.10.0 |
| CVE-2015-9337 | 7.5 | Aug 22 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX Affected: before 2.1.4 |
| CVE-2026-96338 | 6.5 | Sep 30 | WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability Affected: through 4.0.2 |
| CVE-2023-0814 | 6.5 | Feb 14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up… Affected: through 3.9.0 |
| CVE-2024-22142 | 6.1 | Jan 13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects… Affected: through 3.10.0 |
| CVE-2022-0653 | 6.1 | Feb 24 | The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url… Affected: through 3.6.1 |
| CVE-2016-10911 | 6.1 | Aug 21 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues Affected: before 2.4.2 |
| CVE-2015-9328 | 6.1 | Aug 21 | The profile-builder plugin before 2.2.5 for WordPress has XSS Affected: before 2.2.5 |
| CVE-2014-10380 | 6.1 | Aug 21 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms Affected: before 1.1.66 |
| CVE-2014-8492 | 6.1 | Oct 6 | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject… Affected: through 2.0.2 |
| CVE-2026-66701 | 5.3 | Aug 6 | WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability Affected: through 3.16.5 |
| CVE-2024-6708 | 4.8 | May 15 | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to… Affected: before 3.12.2 |
| CVE-2022-0884 | 4.8 | Apr 4 | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform… Affected: before 3.6.8 |
| CVE-2021-24448 | 4.8 | Aug 2 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high… Affected: before 3.4.8 |
| CVE-2025-49292 | 4.3 | Jun 6 | WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability Affected: through 3.13.8 |
| CVE-2023-6504 | 4.3 | Jan 11 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing… Affected: through 3.10.7 |
| CVE-2023-4059 | 4.3 | Sep 4 | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and… Affected: before 3.9.8 |
| CVE-2021-36915 | 4.3 | Oct 11 | WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability Affected: through 3.6.0 |
Showing 26