Cozmoslabs vulnerabilities

Products

• Profile Builder 23
• User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 21
• Paid Member Subscriptions 15
• Profile Builder 10
• Translatepress – Translate Multilingual Sites With Ai Translation 10
• Translatepress 9
• Membership \& Content Restriction - Paid Member Subscriptions 7
• Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction 7
• Profile Builder Pro 6
• User Profile Picture 4
• User Profile Picture 3
• Paid Member Subscriptions 2
• Wp Webhooks 2

Newest

• cozmoslabs translatepress WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-121765 7.1 HighNovember 7, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability CVE-2026-119523 5.3 MediumNovember 7, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint CVE-2026-120537 7.2 HighNovember 7, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass CVE-2026-119167 7.2 HighNovember 7, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-119521 6.5 MediumNovember 3, 2026
• cozmoslabs profile builder WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-54855 7.1 HighOctober 30, 2026
• cozmoslabs profile builder WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability CVE-2026-54854 6.3 MediumOctober 30, 2026
• cozmoslabs profile builder WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability CVE-2026-54853 5.3 MediumOctober 29, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute CVE-2026-115807 7.1 HighOctober 24, 2026
• cozmoslabs profile builder Profile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA Bypass CVE-2026-111965 4.3 MediumOctober 23, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability CVE-2026-112842 6.5 MediumOctober 22, 2026
• cozmoslabs profile builder WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability CVE-2026-112242 8.8 HighOctober 22, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers CVE-2026-107768 7.2 HighOctober 16, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field CVE-2026-100186 7.2 HighOctober 16, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] CVE-2026-109447 8.1 HighOctober 16, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter CVE-2026-107748 6.4 MediumOctober 16, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability CVE-2026-105317 8.5 HighOctober 6, 2026
• cozmoslabs translatepress WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability CVE-2026-103062 7.1 HighOctober 4, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability CVE-2026-97249 5.3 MediumSeptember 30, 2026
• cozmoslabs profile builder WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-96338 6.5 MediumSeptember 30, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field CVE-2026-95866 7.2 HighSeptember 25, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field CVE-2026-93656 6.4 MediumSeptember 25, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel CVE-2026-89412 7.2 HighSeptember 22, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field CVE-2026-6431 7.2 HighSeptember 7, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter CVE-2026-75964 6.1 MediumSeptember 1, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute CVE-2026-75965 6.4 MediumSeptember 1, 2026
• cozmoslabs profile builder plugin Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload CVE-2026-82607 6.9 MediumAugust 31, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser CVE-2026-76053 7.2 HighAugust 28, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure CVE-2026-19632 Public exploit 9.8 CriticalAugust 26, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor CVE-2026-18512 6.4 MediumAugust 25, 2026
• cozmoslabs translatepress WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability CVE-2026-78267 9.8 CriticalAugust 24, 2026
• cozmoslabs translatepress WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-66582 7.1 HighAugust 20, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting CVE-2026-75981 7.2 HighAugust 19, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter CVE-2026-15826 Public exploit 9.8 CriticalAugust 15, 2026
• cozmoslabs profile builder WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability CVE-2026-66701 5.3 MediumAugust 6, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-18510 7.2 HighAugust 6, 2026
• cozmoslabs translatepress – translate multilingual sites with ai translation TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting CVE-2026-17505 6.1 MediumAugust 5, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-59539 7.5 HighJuly 27, 2026
• cozmoslabs user profile picture WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-61971 2.7 LowJuly 13, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-57348 7.2 HighJuly 2, 2026
• cozmoslabs profile builder pro WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-42385 7.1 HighJune 17, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2026-39514 7.1 HighJune 15, 2026
• cozmoslabs profile builder pro Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection CVE-2026-7647 8.1 HighMay 2, 2026
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignmen… CVE-2026-3139 4.3 MediumMarch 31, 2026
• cozmoslabs profile builder pro WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability CVE-2026-27413 9.3 CriticalMarch 19, 2026
• cozmoslabs paid member subscriptions WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-68514 6.5 MediumFebruary 20, 2026
• cozmoslabs wp webhooks WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability CVE-2025-66074 9.0 CriticalDecember 18, 2025
• cozmoslabs wp webhooks WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability CVE-2025-66073 7.2 HighNovember 21, 2025
• cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editor User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-13054 6.4 MediumNovember 19, 2025
• cozmoslabs translatepress WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability CVE-2025-58592 8.1 HighNovember 6, 2025
• Show olderLoading…