User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor
Monthly
The WordPress plugin User Profile Builder (Beautiful User Registration Forms, User Profiles & User Role Editor) through version 4.0.3 lets an authenticated user with Author-level access or higher create brand-new WordPress accounts that carry the Editor role, because the Gutenberg 'Register' block forwards an attacker-supplied Assigned Role attribute straight into the [wppb-register] shortcode with no server-side authorization check. The built-in role guard only strips roles that hold the manage_options or remove_users capability, so Administrator is blocked but Editor and every other privileged non-Administrator role passes through untouched, giving a limited - not full-admin - privilege escalation with high integrity impact (CVSS 7.1, PR:L). No public exploit code or CISA KEV entry was identified at time of analysis, and the issue is rated a this-week, moderate-priority fix rather than an emergency.
Stored cross-site scripting in the WordPress Profile Builder plugin (Cozmoslabs) affects all versions up to and including 4.0.3 and lets unauthenticated remote attackers plant arbitrary JavaScript through the First Name registration field, which executes in the browser of any user who later views the injected page - realistically an administrator processing pending registrations. The attack is explicitly gated on the plugin's Email Confirmation feature being enabled, so sites using default or other registration flows are not reachable through this path. Scoring is CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change reflecting script execution in the victim's browser context, and no public exploit has been identified at time of analysis.
Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder) through version 4.0.2 allows unauthenticated attackers to write raw, unsanitized input into a user's avatar meta by submitting a zero-length multipart file to any public registration or edit-profile form that exposes the Avatar field; the payload then lies dormant until a victim - typically an administrator - views the affected account, at which point it is rendered unescaped as an attachment URL. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), indicating remote and unauthenticated injection with low confidentiality and integrity impact and a scope change because the script executes within the WordPress administrative context; the practical trigger still depends on a privileged user subsequently loading the injected profile. No public exploit code has been identified and no active exploitation has been confirmed - it is a genuine but moderate-priority issue that should be prioritized where public registration forms with the Avatar field are exposed.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress Profile Builder plugin (CozmoLabs) affects all versions up to and including 4.0.3 and allows an authenticated subscriber-level user to inject persistent JavaScript that executes in the browsers of anyone viewing an affected page. The payload is written through the 'display_name' parameter and, critically, is stored in wp_comments.comment_author, so it survives deleting or renaming the attacker's account and continues to fire as long as the poisoned comment is rendered. Exploitation requires the target site to allow self-service registration or the attacker to already hold a low-privilege account; no public exploit identified at time of analysis, and the plugin's own vendor-reported severity is moderate (CVSS 6.4, PR:L, scope-changed).
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder by Cozmoslabs) through version 4.0.2 lets any authenticated user with Subscriber-level access plant script content in their avatar value and have it execute in a higher-privileged user's browser. The distinguishing enabler is a nonce-free GET request to /wp-admin/profile.php that writes a malicious attachment URL as the avatar without any profile-form submission or valid nonce, so a Subscriber only needs to reach that endpoint to seed the payload. The script then fires when an administrator opens that user's Edit User screen - a victim action that limits automatic exploitation - and the CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), with no public exploit code identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
User Profile Builder plugin for WordPress up to version 3.15.5 allows authenticated subscribers and above to reassign ownership of arbitrary posts and attachments through insecure direct object reference (IDOR) in the wppb_save_avatar_value() function. The vulnerability lacks validation on user-controlled keys, enabling privilege escalation where low-privileged users can modify post_author fields to take control of content created by other users. No public exploit code or active exploitation has been identified at time of analysis.
The WordPress plugin User Profile Builder (Beautiful User Registration Forms, User Profiles & User Role Editor) through version 4.0.3 lets an authenticated user with Author-level access or higher create brand-new WordPress accounts that carry the Editor role, because the Gutenberg 'Register' block forwards an attacker-supplied Assigned Role attribute straight into the [wppb-register] shortcode with no server-side authorization check. The built-in role guard only strips roles that hold the manage_options or remove_users capability, so Administrator is blocked but Editor and every other privileged non-Administrator role passes through untouched, giving a limited - not full-admin - privilege escalation with high integrity impact (CVSS 7.1, PR:L). No public exploit code or CISA KEV entry was identified at time of analysis, and the issue is rated a this-week, moderate-priority fix rather than an emergency.
Stored cross-site scripting in the WordPress Profile Builder plugin (Cozmoslabs) affects all versions up to and including 4.0.3 and lets unauthenticated remote attackers plant arbitrary JavaScript through the First Name registration field, which executes in the browser of any user who later views the injected page - realistically an administrator processing pending registrations. The attack is explicitly gated on the plugin's Email Confirmation feature being enabled, so sites using default or other registration flows are not reachable through this path. Scoring is CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change reflecting script execution in the victim's browser context, and no public exploit has been identified at time of analysis.
Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder) through version 4.0.2 allows unauthenticated attackers to write raw, unsanitized input into a user's avatar meta by submitting a zero-length multipart file to any public registration or edit-profile form that exposes the Avatar field; the payload then lies dormant until a victim - typically an administrator - views the affected account, at which point it is rendered unescaped as an attachment URL. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), indicating remote and unauthenticated injection with low confidentiality and integrity impact and a scope change because the script executes within the WordPress administrative context; the practical trigger still depends on a privileged user subsequently loading the injected profile. No public exploit code has been identified and no active exploitation has been confirmed - it is a genuine but moderate-priority issue that should be prioritized where public registration forms with the Avatar field are exposed.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the WordPress Profile Builder plugin (CozmoLabs) affects all versions up to and including 4.0.3 and allows an authenticated subscriber-level user to inject persistent JavaScript that executes in the browsers of anyone viewing an affected page. The payload is written through the 'display_name' parameter and, critically, is stored in wp_comments.comment_author, so it survives deleting or renaming the attacker's account and continues to fire as long as the poisoned comment is rendered. Exploitation requires the target site to allow self-service registration or the attacker to already hold a low-privilege account; no public exploit identified at time of analysis, and the plugin's own vendor-reported severity is moderate (CVSS 6.4, PR:L, scope-changed).
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder by Cozmoslabs) through version 4.0.2 lets any authenticated user with Subscriber-level access plant script content in their avatar value and have it execute in a higher-privileged user's browser. The distinguishing enabler is a nonce-free GET request to /wp-admin/profile.php that writes a malicious attachment URL as the avatar without any profile-form submission or valid nonce, so a Subscriber only needs to reach that endpoint to seed the payload. The script then fires when an administrator opens that user's Edit User screen - a victim action that limits automatic exploitation - and the CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N per our assessment), with no public exploit code identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
User Profile Builder plugin for WordPress up to version 3.15.5 allows authenticated subscribers and above to reassign ownership of arbitrary posts and attachments through insecure direct object reference (IDOR) in the wppb_save_avatar_value() function. The vulnerability lacks validation on user-controlled keys, enabling privilege escalation where low-privileged users can modify post_author fields to take control of content created by other users. No public exploit code or active exploitation has been identified at time of analysis.