User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities

Product

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

by cozmoslabs · last CVE Oct 24, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities16 In the news0 Timeline

Severity mix

Critical 1High 5Medium 10Low 0

Severity

All severities16 Critical1 High5 Medium10 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-109447	8.1	0%	Oct 16	User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] Affected: through 4.0.3
CVE-2026-100186	7.2	0%	Oct 16	User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field Affected: through 4.0.3
CVE-2026-95866	7.2	0%	Sep 25	User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field Affected: through 4.0.2
CVE-2026-6431	7.2	0%	Sep 7	User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field Affected: through 3.15.7
CVE-2026-115807 New	7.1	0%	Oct 24	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute Affected: through 4.0.3