Unknown User Profile Builder vulnerabilities

• unknown user profile builder Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change CVE-2026-111982 7.2 HighOctober 23, 2026
• unknown user profile builder Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute CVE-2026-111966 6.8 MediumOctober 23, 2026
• unknown user profile builder Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions CVE-2026-111948 7.1 HighOctober 21, 2026
• unknown user profile builder Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass CVE-2026-76548 8.2 HighAugust 29, 2026
• unknown user profile builder Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export CVE-2026-76547 Public exploit 6.6 MediumAugust 29, 2026
• unknown user profile builder Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode CVE-2026-76546 6.8 MediumAugust 29, 2026
• unknown user profile builder Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration CVE-2026-15368 8.1 HighAugust 1, 2026
• unknown user profile builder User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset CVE-2025-15030 Public exploit 9.8 CriticalFebruary 2, 2026
• cozmoslabs profile builder, unknown user profile builder +1 more Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting CVE-2024-6708 4.8 MediumMay 15, 2025
• cozmoslabs profile builder, unknown user profile builder +1 more profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation CVE-2024-6695 9.8 CriticalJuly 31, 2024
• cozmoslabs profile builder, unknown user profile builder +1 more User Profile Builder < 3.11.8 - Unauthenticated Media Upload CVE-2024-6366 Public exploit EPSS 29.0% 9.1 CriticalJuly 29, 2024
• wpusermanager wp user manager, unknown wp user manager – user profile builder & membership +1 more WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise CVE-2021-24655 7.5 HighJuly 17, 2022
• khaledsaikat user meta – user profile builder and user management plugin, user-meta user meta user profile builder and user management +1 more User Meta < 2.4.4 - Subscriber+ Local File Enumeration via Path Traversal CVE-2022-0779 6.5 MediumJune 6, 2022
• khaledsaikat user meta – user profile builder and user management plugin, user-meta user meta user profile builder and user management +1 more User Meta < 2.4.3 - Admin+ Stored Cross-Site Scripting CVE-2022-0376 4.8 MediumMay 30, 2022