Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

• CVE-2026-115807 High 7.1 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute 0.2%
• CVE-2026-100186 High 7.2 User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field 0.2%
• CVE-2026-109447 High 8.1 User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] 0.3%
• CVE-2026-107748 Medium 6.4 User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter 0.2%
• CVE-2026-95866 High 7.2 User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field 0.3%
• CVE-2026-93656 Medium 6.4 User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field 0.2%
• CVE-2026-6431 High 7.2 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field 0.4%
• CVE-2026-75964 Medium 6.1 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter 0.4%
• CVE-2026-75965 Medium 6.4 User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute 0.3%
• CVE-2026-15826 Critical 9.8 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter 3.9%
• CVE-2026-3139 Medium 4.3 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field 0.2%
• CVE-2025-13054 Medium 6.4 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.2%
• CVE-2025-8896 Medium 6.4 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting 0.2%
• CVE-2025-4671 Medium 6.4 Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes 0.3%
• CVE-2025-2314 Medium 6.4 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
• CVE-2024-12738 Medium 6.1 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting 0.4%
• CVE-2024-0324 High 8.2 User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update 2.4%
• CVE-2023-6504 Medium 4.3 Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode 0.3%
• CVE-2023-47669 Medium 5.4 WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
• CVE-2023-2297 Critical 9.8 Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism 1.0%
• CVE-2023-0814 Medium 6.5 Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode 0.8%