Skip to main content

User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor

4 CVEs product

Monthly

CVE-2026-6431 Sep 07, 12:29 HIGH This Week

Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.

WordPress XSS User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor Wordpress Plugin Cozmoslabs
NVD
CVSS 3.1
7.2
EPSS
0.2%
CVE-2026-75964 Sep 01, 05:30 MEDIUM This Month

Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.

WordPress XSS User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor Wordpress Plugin Cozmoslabs
NVD VulDB
CVSS 3.1
6.1
EPSS
0.2%
CVE-2026-75965 Sep 01, 04:27 MEDIUM This Month

Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.

WordPress XSS User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor Wordpress Plugin Cozmoslabs
NVD
CVSS 3.1
6.4
EPSS
0.2%
CVE-2026-3139 Mar 31, 11:18 MEDIUM This Month

User Profile Builder plugin for WordPress up to version 3.15.5 allows authenticated subscribers and above to reassign ownership of arbitrary posts and attachments through insecure direct object reference (IDOR) in the wppb_save_avatar_value() function. The vulnerability lacks validation on user-controlled keys, enabling privilege escalation where low-privileged users can modify post_author fields to take control of content created by other users. No public exploit code or active exploitation has been identified at time of analysis.

WordPress Authentication Bypass User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor Wordpress Plugin Cozmoslabs
NVD VulDB
CVSS 3.1
4.3
EPSS
0.0%
EPSS 0% CVSS 7.2
HIGH This Week

Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.

WordPress XSS User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor +2
NVD
EPSS 0% CVSS 6.1
MEDIUM This Month

Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.

WordPress XSS User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor +2
NVD VulDB
EPSS 0% CVSS 6.4
MEDIUM This Month

Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.

WordPress XSS User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor +2
NVD
EPSS 0% CVSS 4.3
MEDIUM This Month

User Profile Builder plugin for WordPress up to version 3.15.5 allows authenticated subscribers and above to reassign ownership of arbitrary posts and attachments through insecure direct object reference (IDOR) in the wppb_save_avatar_value() function. The vulnerability lacks validation on user-controlled keys, enabling privilege escalation where low-privileged users can modify post_author fields to take control of content created by other users. No public exploit code or active exploitation has been identified at time of analysis.

WordPress Authentication Bypass User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor +2
NVD VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy