Log in Start free

Cozmoslabs

Products

ProductCVEsExploitedLatest
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor21–Oct 24, 2026
Paid Member Subscriptions14–Nov 3, 2026
TranslatePress – Translate Multilingual sites with AI Translation10–Nov 7, 2026
Profile Builder8–Oct 30, 2026
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction7–Nov 5, 2025
Profile Builder Pro6–Jun 17, 2026
TranslatePress5–Oct 4, 2026
User Profile Picture2–Jul 13, 2026
WP Webhooks2–Dec 18, 2025
WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress1–Aug 21, 2025
Profile Builder – User Profile & User Registration Forms1–Feb 24, 2022
Profile Builder – User Profile & User Registration Forms (WordPress plugin)1–Oct 11, 2022
Profile Builder Plugin1–Aug 31, 2026

Exploited and recent CVEs

  • CVE-2026-120537 High 7.2 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint –
  • CVE-2026-119167 High 7.2 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass –
  • CVE-2026-119521 Medium 6.5 WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-54855 High 7.1 WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-54854 Medium 6.3 WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability 0.2%
  • CVE-2026-54853 Medium 5.3 WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability 0.2%
  • CVE-2026-115807 High 7.1 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute 0.2%
  • CVE-2026-112842 Medium 6.5 WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability 0.2%
  • CVE-2026-112242 High 8.8 WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability 0.3%
  • CVE-2026-107768 High 7.2 TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers 0.3%
  • CVE-2026-100186 High 7.2 User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field 0.2%
  • CVE-2026-109447 High 8.1 User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] 0.3%
  • CVE-2026-107748 Medium 6.4 User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter 0.2%
  • CVE-2026-105317 High 8.5 WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability 0.3%
  • CVE-2026-103062 High 7.1 WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-97249 Medium 5.3 WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability 0.2%
  • CVE-2026-96338 Medium 6.5 WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-95866 High 7.2 User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field 0.3%
  • CVE-2026-93656 Medium 6.4 User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field 0.2%
  • CVE-2026-89412 High 7.2 TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel 0.5%
  • CVE-2026-6431 High 7.2 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field 0.4%
  • CVE-2026-75964 Medium 6.1 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter 0.4%
  • CVE-2026-75965 Medium 6.4 User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute 0.3%
  • CVE-2026-82607 High 7.3 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload 0.5%
  • CVE-2026-76053 High 7.2 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser 0.8%
  • CVE-2026-19632 Critical 9.8 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure 4.5%
  • CVE-2026-18512 Medium 6.4 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor 0.4%
  • CVE-2026-78267 Critical 9.8 WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability 0.5%
  • CVE-2026-66582 High 7.1 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-75981 High 7.2 TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting 0.4%