Skip to contentCozmoslabs Profile Builder vulnerabilities
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.6 - Broken Access Control vulnerabilityCVE-2026-1257765.3 Medium
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.6 - Sensitive Data Exposure vulnerabilityCVE-2026-1257775.3 Medium
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-548557.1 High
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerabilityCVE-2026-548546.3 Medium
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerabilityCVE-2026-548535.3 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' AttributeCVE-2026-1158077.1 High
- cozmoslabs profile builderProfile Builder 4.0.0 - 4.0.4 - Subscriber+ Comment reCAPTCHA BypassCVE-2026-1119654.3 Medium
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerabilityCVE-2026-1122428.8 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name FieldCVE-2026-1001867.2 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]CVE-2026-1094478.1 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' ParameterCVE-2026-1077486.4 Medium
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-963386.5 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar FieldCVE-2026-958667.2 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar FieldCVE-2026-936566.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta FieldCVE-2026-64317.2 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' ParameterCVE-2026-759646.1 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode AttributeCVE-2026-759656.4 Medium
- cozmoslabs profile builder pluginCozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted uploadCVE-2026-826076.9 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' ParameterCVE-2026-15826Public exploit9.8 Critical
- cozmoslabs profile builderWordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerabilityCVE-2026-667015.3 Medium
- cozmoslabs profile builder proWordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-423857.1 High
- cozmoslabs profile builder proProfile Builder Pro <= 3.14.5 - Unauthenticated PHP Object InjectionCVE-2026-76478.1 High
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignmen…CVE-2026-31394.3 Medium
- cozmoslabs profile builder proWordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerabilityCVE-2026-274139.3 Critical
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2025-130546.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingCVE-2025-88966.4 Medium
- cozmoslabs profile builderWordPress Profile Builder plugin <= 3.13.8 - Content Spoofing VulnerabilityCVE-2025-492924.3 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorProfile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare ShortcodesCVE-2025-46716.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2025-23146.4 Medium
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site ScriptingCVE-2024-127386.1 Medium
- cozmoslabs profile builderWordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerabilityCVE-2024-313415.3 Medium
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreUser Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_updateCVE-2024-0324Public exploit8.2 High
- cozmoslabs profile builder pro, profile builder +1 moreWordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2024-221408.8 High
- cozmoslabs profile builder pro, profile builder +1 moreWordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data ExposureCVE-2024-221416.5 Medium
- cozmoslabs profile builder pro, profile builder +1 moreWordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)CVE-2024-221427.1 High
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreProfile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta ShortcodeCVE-2023-65044.3 Medium
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreWordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-476695.4 Medium
- cozmoslabs profile builderProfile Builder < 3.9.8 - Unauthenticated Plugin's Pages CreationCVE-2023-40594.3 Medium
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset MechanismCVE-2023-22979.8 Critical
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via ShortcodeCVE-2023-08146.5 Medium
- cozmoslabs profile builder, profile builder – user profile & user registration forms (wordpress plugin) +1 moreWordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2021-369154.2 Medium
- cozmoslabs profile builder – user profile & user registration forms, profile builder +1 moreProfile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site ScriptingCVE-2022-06536.1 Medium