Cozmoslabs Profile Builder

User Profile Builder 3.15.7: Stored XSS via BiographicalInfo meta
CVE-2026-6431 7.2 - High - September 07, 2026

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

XSS

Stored XSS via email param in UPB 4.0.0
CVE-2026-75964 6.1 - Medium - September 01, 2026

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manage_options capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by row_actions().

XSS

User Profile Builder WP XSS via 'date' Shortcode (v4.0.0)
CVE-2026-75965 6.4 - Medium - September 01, 2026

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.

XSS

WordPress UProfileBuilder 3.16.4 Auth Bypass via Type Confusion
CVE-2026-15826 9.8 - Critical - August 15, 2026

The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check when a registration is submitted with a 6170 character username, WordPress core rejects it with a WP_Error object, but absint() coerces that object to the integer 1 before the error check can short-circuit execution, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This makes it possible for unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover of the site.

Incorrect Type Conversion or Cast

Unauthenticated BAC in Profile Builder 3.16.5 Plugin
CVE-2026-66701 5.3 - Medium - August 06, 2026

Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.

AuthZ

Unauthenticated XSS in Profile Builder Pro <=3.15.0
CVE-2026-42385 7.1 - High - June 17, 2026

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

XSS

Profile Builder Pro 3.14.5 PHP Object Injection via maybe_unserialize()
CVE-2026-7647 8.1 - High - May 02, 2026

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybe_unserialize() function on the attacker-controlled 'args' POST parameter within the wppb_request_users_pins_action_callback() AJAX handler, which lacked any nonce verification, type checking, or input validation before deserialization. Because the handler was registered with both wp_ajax_ and wp_ajax_nopriv_ hooks, it was reachable by completely unauthenticated users. This makes it possible for unauthenticated attackers to inject arbitrary PHP objects into application memory.

Marshaling, Unmarshaling

User Profile Builder WP Plugin 3.15.5 I2O: Auth Attacker Reassigns Post Author
CVE-2026-3139 4.3 - Medium - March 31, 2026

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.

Insecure Direct Object Reference / IDOR

Cozmoslabs Profile Builder Pro 3.13.9 SQLi Blind Injection
CVE-2026-27413 9.3 - Critical - March 19, 2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0.

SQL Injection

User Profile Builder 3.14.8 XSS via wppb-embed shortcode
CVE-2025-13054 6.4 - Medium - November 19, 2025

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

XSS

Stored XSS in User Profile Builder <=3.14.3 (GDPR Preferences)
CVE-2025-8896 6.4 - Medium - August 16, 2025

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form.

XSS

Cozmoslabs Profile Builder 3.13.8: Improper Quantity Validation Allows Phishing
CVE-2025-49292 - June 06, 2025

Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder allows Phishing. This issue affects Profile Builder: from n/a through 3.13.8.

Improper Validation of Specified Quantity in Input

WP User Profile Builder XSS in admin area before 3.12.2
CVE-2024-6708 - May 15, 2025

The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.

XSS

Stored XSS in User Profile Builder < 3.13.6 (WordPress)
CVE-2025-2314 6.4 - Medium - April 16, 2025

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially patched in version 3.13.6 of the plugin, and fully patched in 3.13.7.

XSS

U PB Stored XSS via User Meta in WP Plugin <=3.12.9
CVE-2024-12738 6.1 - Medium - January 07, 2025

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.

XSS

Unauth Media Upload in User Profile Builder WP Plugin <3.11.8
CVE-2024-6366 - July 29, 2024

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.

Unrestricted File Upload

Cozmoslabs Profile Builder 3.11.2 Functionality Bypass
CVE-2024-31341 - May 17, 2024

Insufficient Verification of Data Authenticity vulnerability in Cozmoslabs Profile Builder allows Functionality Bypass.This issue affects Profile Builder: from n/a through 3.11.2.

Insufficient Verification of Data Authenticity

User Profile Builder WP Plugin 2FA Settings Unauthorized Modification (3.10.8)
CVE-2024-0324 8.2 - High - February 05, 2024

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles.

Authorization

CVE-2024-22140: CSRF in Cozmoslabs Profile Builder Pro 3.10
CVE-2024-22140 8.8 - High - January 31, 2024

Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.

Session Riding

Cozmoslabs Profile Builder Pro <3.10.0 Info Leakage (UAT)
CVE-2024-22141 7.5 - High - January 24, 2024

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0.

Information Disclosure

Cozmoslabs Profile Builder Pro <3.10.0 Reflected XSS in Web Page Generation
CVE-2024-22142 6.1 - Medium - January 13, 2024

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This issue affects Profile Builder Pro: from n/a through 3.10.0.

XSS

User Profile Builder <=3.10.7 Unauthorized Meta Access
CVE-2023-6504 4.3 - Medium - January 11, 2024

The User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.

Insecure Direct Object Reference / IDOR

CVE-2023-47669: CSRF in Cozmoslabs User Profile Builder <=3.10.3
CVE-2023-47669 8.8 - High - November 13, 2023

Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.10.3 versions.

ProfBuilder WP Plugin <3.9.8: Auth & CSRF Bypass Unauth Page Creation
CVE-2023-4059 4.3 - Medium - September 04, 2023

The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog

Session Riding

Profile Builder WP Plugin 3.9.0 Unauthorized Password Reset
CVE-2023-2297 9.8 - Critical - April 27, 2023

The Profile Builder User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.

Unverified Password Change

Profile Builder WP Plugin 3.9.0 Sensitive Meta Disclosure via User_meta
CVE-2023-0814 6.5 - Medium - February 14, 2023

The Profile Builder User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.

Information Disclosure

WordPress Cozmoslabs Profile Builder <=3.6.0 CSRF via JSON Upload
CVE-2021-36915 4.2 - Medium - October 11, 2022

Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the options. Requires Import and Export add-on.

Session Riding

The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could
CVE-2022-0884 4.8 - Medium - April 04, 2022

The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed

XSS

The Profile Builder User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages
CVE-2022-0653 6.1 - Medium - February 24, 2022

The Profile Builder User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.

XSS

The User Registration & User Profile â Profile Builder WordPress plugin before 3.4.9 has a bug
CVE-2021-24527 9.8 - Critical - August 16, 2021

The User Registration & User Profile â Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.

authentification

The User Registration & User Profile â Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting
CVE-2021-24448 4.8 - Medium - August 02, 2021

The User Registration & User Profile â Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue

XSS