Cozmoslabs

By the Year

In 2026 there have been 23 vulnerabilities in Cozmoslabs with an average score of 7.1 out of ten. Last year, in 2025 Cozmoslabs had 16 security vulnerabilities published. That is, 7 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.16

Recent Cozmoslabs Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-6431	Sep 07, 2026	User Profile Builder 3.15.7: Stored XSS via BiographicalInfo meta The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Profile Builder
CVE-2026-75964	Sep 01, 2026	Stored XSS via email param in UPB 4.0.0 The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manage_options capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by row_actions().	Profile Builder
CVE-2026-75965	Sep 01, 2026	User Profile Builder WP XSS via 'date' Shortcode (v4.0.0) The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.	Profile Builder
CVE-2026-82607	Aug 31, 2026	CVE-2026-82607 WP Cozmoslabs Profile Builder 3.16.1 Unrestricted Upload A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 3.16.2 is sufficient to resolve this issue. It is suggested to upgrade the affected component.	Profile Builder Plugin
CVE-2026-76053	Aug 28, 2026	TranslatePress <=3.3.3 Stored XSS via Comment Noise-Key Injection The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation is possible because WordPress's comment KSES allowlist permits the payload structure an anchor tag with href and title attributes alongside a code tag causing the malicious comment to be stored verbatim in the database, where it is later processed by the vulnerable parser during page translation.	Translatepress
CVE-2026-19632	Aug 26, 2026	TranslatePress <=3.3.1 'trp_get_translations_regular' Sensitive Info Exposure The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL including the plaintext reset key and login parameters stored in the translation dictionary table enabling full administrator account takeover. This vulnerability is only exploitable when automatic string saving is enabled (the default setting) and the target administrator's profile locale is set to a published secondary language, as these conditions cause the password-reset URL to be persisted as a translatable string in the secondary-language dictionary table.	Translatepress
CVE-2026-18512	Aug 25, 2026	TranslatePress WP Plugin 3.2.6 XSS via Translation Editor Strings Dropdown The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Translatepress
CVE-2026-78267	Aug 24, 2026	TranslatePress <=3.3.2 Unauth Priv Esc CVE-2026-78267 Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.	Translatepress
CVE-2026-66582	Aug 20, 2026	Unauthenticated XSS in TranslatePress <=3.3.2 Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions.	Translatepress
CVE-2026-75981	Aug 19, 2026	TranslatePress <=3.2.5 Stored XSS via gettext markers The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '#!trpst#' and '#!trpen#' are unconditionally rewritten to '<' and '>' by translate_page() in includes/class-translation-render.php (lines 538-539). Because those markers are plain text with no HTML-special characters, an unauthenticated attacker can embed them in a comment; the markers survive wp_kses, and when the post is viewed in a secondary language the substitution turns the attacker's '#!trpst#img ... #!trpen#' into a real <img> tag. remove_tags_from_output() only strips <script>/<style>, so an <img onerror=...> executes in the visitor's browser.	Translatepress
CVE-2026-15826	Aug 15, 2026	WordPress UProfileBuilder 3.16.4 Auth Bypass via Type Confusion The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check when a registration is submitted with a 6170 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.	Profile Builder
CVE-2026-66701	Aug 06, 2026	Unauthenticated BAC in Profile Builder 3.16.5 Plugin Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.	Profile Builder
CVE-2026-18510	Aug 06, 2026	TranslatePress Plugin XSS via Comment Input (3.2.6) The TranslatePress Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderation may delay exploitation for first-time commenters, but does not prevent it, as the payload uses only WordPress-permitted tags and attributes with percent-encoded characters that pass wp_kses URL validation unmodified.	Translatepress
CVE-2026-17505	Aug 05, 2026	TranslatePress WP plugin <=3.2.5 Reflected XSS via 's' The Translate Multilingual sites TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translate_page() function unconditionally replacing the plugin's internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML page output after WordPress has already sanitized and escaped user input allowing the attacker to bypass WordPress's normal HTML escaping by using these tokens, which are not HTML special characters, in the search query. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.	Translatepress
CVE-2026-59539	Jul 27, 2026	IDOR in Paid Member Subscriptions Subscribers <= 3.0.7 Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions.	Paid Member Subscriptions
CVE-2026-61971	Jul 13, 2026	Cozmoslabs Metronet-PIC: Auth Bypass via User Key <=2.6.3 Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6.3.	User Profile Picture
CVE-2026-57348	Jul 02, 2026	Unauthenticated SSRF in Paid Member Subscriptions <=3.0.4 Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.	Paid Member Subscriptions
CVE-2026-42385	Jun 17, 2026	Unauthenticated XSS in Profile Builder Pro <=3.15.0 Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.	Profile Builder
CVE-2026-39514	Jun 15, 2026	Unauthenticated XSS in Paid Member Subscriptions <=2.17.3 Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.	Paid Member Subscriptions
CVE-2026-7647	May 02, 2026	Profile Builder Pro 3.14.5 PHP Object Injection via maybe_unserialize() The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory.	Profile Builder
CVE-2026-3139	Mar 31, 2026	User Profile Builder WP Plugin 3.15.5 I2O: Auth Attacker Reassigns Post Author The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.	Profile Builder
CVE-2026-27413	Mar 19, 2026	Cozmoslabs Profile Builder Pro 3.13.9 SQLi Blind Injection Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0.	Profile Builder
CVE-2025-68514	Feb 20, 2026	CVE-2025-68514: Auth Bypass via UserCtrl Key in PM Sub <=2.16.8 Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.	Paid Member Subscriptions
CVE-2025-66074	Dec 18, 2025	WP Webhooks <=3.3.8 Unrestricted File Upload & Path Traversal Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8.	Wp Webhooks
CVE-2025-66073	Nov 21, 2025	Cozmoslabs WP Webhooks <=3.3.8: Deserializable Object Injection Vulnerability Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8.	Wp Webhooks
CVE-2025-13054	Nov 19, 2025	User Profile Builder 3.14.8 XSS via wppb-embed shortcode The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	Profile Builder
CVE-2025-58592	Nov 06, 2025	TranslatePress <=2.10.2 Untrusted Data Deserialization Leads to Object Injection Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.10.2.	Translatepress
CVE-2025-11835	Nov 05, 2025	WordPress PMS Plugin <=2.16.4 Unauthorized auto-renew via missing capability The Paid Membership Subscriptions Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability and validation check on the PMS_AJAX_Checkout_Handler::process_payment() function in all versions up to, and including, 2.16.4. This makes it possible for unauthenticated attackers to trigger stored auto-renew charges for arbitrary members.
CVE-2025-58600	Sep 03, 2025	Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.	Paid Member Subscriptions
CVE-2025-8895	Aug 21, 2025	The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including, 3.3.5. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site's server to arbitrary locations. This can be used to copy the contents of wp-config.php into a text file which can then be accessed in a browser to reveal database credentials.	Wp Webhooks
CVE-2025-8896	Aug 16, 2025	Stored XSS in User Profile Builder <=3.14.3 (GDPR Preferences) The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form.	Profile Builder
CVE-2025-49870	Jul 04, 2025	Cozmoslabs Paid Member Subscriptions <=2.15.1 SQL Injection Vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows SQL Injection.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.1.	Paid Member Subscriptions
CVE-2025-49292	Jun 06, 2025	Cozmoslabs Profile Builder 3.13.8: Improper Quantity Validation Allows Phishing Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder allows Phishing. This issue affects Profile Builder: from n/a through 3.13.8.	Profile Builder
CVE-2024-6708	May 15, 2025	WP User Profile Builder XSS in admin area before 3.12.2 The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.	Profile Builder
CVE-2025-2314	Apr 16, 2025	Stored XSS in User Profile Builder < 3.13.6 (WordPress) The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially patched in version 3.13.6 of the plugin, and fully patched in 3.13.7.	Profile Builder
CVE-2025-31088	Mar 28, 2025	Cozmoslabs Paid Member Subscriptions 2.14.3 XSS Stored Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through <= 2.14.3.	Paid Member Subscriptions
CVE-2025-30773	Mar 27, 2025	CVE-2025-30773 TranslatePress <=2.9.6 Object Injection via Deserialization Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.	Translatepress
CVE-2024-12919	Jan 14, 2025	WordPress Paid Membership Subscriptions Auth Bypass v<=2.13.7 The Paid Membership Subscriptions Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.13.7. This is due to the pms_pb_payment_redirect_link function using the user-controlled value supplied via the 'pms_payment_id' parameter to authenticate users without any further identity validation. This makes it possible for unauthenticated attackers with knowledge of a valid payment ID to log in as any user who has made a purchase on the targeted site.	Membership Content Restriction Paid Member Subscriptions
CVE-2024-12738	Jan 07, 2025	U PB Stored XSS via User Meta in WP Plugin <=3.12.9 The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.	Profile Builder
CVE-2024-11291	Dec 18, 2024	WordPress Paid Membership Subscriptions Plugin Sensitive Information Exposure via Search The Paid Membership Subscriptions Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.4 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as logged-in users.	Membership Content Restriction Paid Member Subscriptions
CVE-2024-10261	Nov 09, 2024	Effortless Memberships Shortcode Execution Flaw The The Paid Membership Subscriptions Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.13.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.	Membership Content Restriction Paid Member Subscriptions Paid Member Subscriptions
CVE-2024-9222	Oct 02, 2024	Paid Membership Subscriptions (<=2.12.8) Reflected XSS via add_query_arg The Paid Membership Subscriptions Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.12.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.	Membership Content Restriction Paid Member Subscriptions
CVE-2024-6366	Jul 29, 2024	Unauth Media Upload in User Profile Builder WP Plugin <3.11.8 The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.	Profile Builder
CVE-2024-5639	Jun 21, 2024	WordPress UserProfilePic 2.6.1 IDOR via rest_api_change_profile_image The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update the profile picture of any user.	User Profile Picture
CVE-2024-31341	May 17, 2024	Cozmoslabs Profile Builder 3.11.2 Functionality Bypass Insufficient Verification of Data Authenticity vulnerability in Cozmoslabs Profile Builder allows Functionality Bypass.This issue affects Profile Builder: from n/a through 3.11.2.	Profile Builder
CVE-2023-51522	Mar 15, 2024	CSRF Vulnerability in Cozmoslabs Paid Member Subscriptions < 2.10.4 Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4.	Paid Membership Subscriptions
CVE-2024-1389	Feb 29, 2024	WP Paid Membership Subscriptions 2.11.1 Cap Check Bypass The Paid Membership Subscriptions Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.	Membership Content Restriction Paid Member Subscriptions
CVE-2024-1390	Feb 29, 2024	WP PaidMembershipSubs v2.11.1 missing capability, pricing table creation The Paid Membership Subscriptions Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creating_pricing_table_page function in all versions up to, and including, 2.11.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create pricing tables.	Membership Content Restriction Paid Member Subscriptions
CVE-2024-0324	Feb 05, 2024	User Profile Builder WP Plugin 2FA Settings Unauthorized Modification (3.10.8) The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles.	Profile Builder
CVE-2024-22140	Jan 31, 2024	CVE-2024-22140: CSRF in Cozmoslabs Profile Builder Pro 3.10 Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.	Profile Builder