WordPress plugin · profile-builder
Is User Profile Builder safe?
Safe on 4.0.5 or newer.
The current version, 4.0.5, is past every affected range on record (47 of 47 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 47
- High or critical
- 17
- Exploited
- none
- Current version
- 4.0.5
- Last updated
- Oct 19, 2026
- Active installs
- 40,000+
Every recorded flaw
- Oct 24, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Limited Privilege EscalationCVE-2026-115807 · affects up to 4.0.3 · reported by WordfenceHigh 7.1
- Oct 23, 2026User Profile Builder: Does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile formCVE-2026-111982 · fixed in 4.0.5 · reported by WPScanHigh 7.2
- Oct 23, 2026User Profile Builder: Does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect messageCVE-2026-111966 · fixed in 4.0.5 · reported by WPScanMedium 6.8
- Oct 22, 2026Profile Builder: Incorrect Privilege AssignmentCVE-2026-112242 · affects up to 4.0.4 · reported by PatchstackHigh 8.8
- Oct 21, 2026User Profile Builder: Does not escape the current page URL before outputting it in a JavaScript context on one of its admin pagesCVE-2026-111948 · fixed in 4.0.1 · reported by WPScanHigh 7.1
- Oct 16, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Privilege EscalationCVE-2026-109447 · affects up to 4.0.3 · reported by WordfenceHigh 8.1
- Oct 16, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-107748 · affects up to 4.0.3 · reported by WordfenceMedium 6.4
- Oct 16, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-100186 · affects up to 4.0.3 · reported by WordfenceHigh 7.2
- Sep 30, 2026Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.CVE-2026-96338 · affects up to 4.0.2 · reported by PatchstackMedium 6.5
- Sep 25, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-95866 · affects up to 4.0.2 · reported by WordfenceHigh 7.2
- Sep 25, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-93656 · affects up to 4.0.2 · reported by WordfenceMedium 6.4
- Sep 7, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-6431 · affects up to 3.15.7 · reported by WordfenceHigh 7.2
- Sep 1, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-75964 · affects up to 4.0.0 · reported by WordfenceMedium 6.1
- Sep 1, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-75965 · affects up to 4.0.0 · reported by WordfenceMedium 6.4
- Aug 30, 2026A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress.CVE-2026-82607 · affects up to 3.16.1 · reported by VulDBMedium 5.5
- Aug 29, 2026User Profile Builder: Does not properly restrict its front-end file upload featureCVE-2026-76548 · fixed in 4.0.1 · reported by WPScanHigh 8.2
- Aug 29, 2026User Profile Builder: Does not validate the type of data being deserializedCVE-2026-76547 · fixed in 4.0.1 · reported by WPScanMedium 6.6
- Aug 29, 2026User Profile Builder: Does not escape the output of one of its optional shortcodesCVE-2026-76546 · fixed in 4.0.1 · reported by WPScanMedium 6.8
- Aug 15, 2026User Profile Builder: Authentication BypassCVE-2026-15826 · affects up to 3.16.4 · reported by Wordfence3.9% oddsCritical 9.8
- Aug 6, 2026Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.CVE-2026-66701 · affects up to 3.16.5 · reported by PatchstackMedium 5.3
- Aug 1, 2026User Profile Builder: Does not correctly bind the automatic login performed after user registration to the newly created accountCVE-2026-15368 · fixed in 3.16.4 · reported by WPScanHigh 8.1
- Mar 31, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Insecure Direct Object ReferenceCVE-2026-3139 · affects up to 3.15.5 · reported by WordfenceMedium 4.3
- Feb 2, 2026User Profile Builder: Does not have a proper password reset processCVE-2025-15030 · fixed in 3.15.2 · reported by WPScanCritical 9.8
- Nov 19, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2025-13054 · affects up to 3.14.8 · reported by WordfenceMedium 6.4
- Aug 16, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2025-8896 · affects up to 3.14.3 · reported by WordfenceMedium 6.4
- Jun 6, 2025Profile Builder: Improper Validation of Specified Quantity in InputCVE-2025-49292 · affects up to 3.13.8 · reported by PatchstackMedium 4.3
- Jun 3, 2025Profile Builder: Stored Cross-Site ScriptingCVE-2025-4671 · affects up to 3.13.8 · reported by WordfenceMedium 6.4
- May 15, 2025User Profile Builder: Does not sanitise and escape some parameters before outputting its content on the admin areaCVE-2024-6708 · fixed in 3.12.2 · reported by WPScanMedium 4.8
- Apr 15, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2025-2314 · affects up to 3.13.5 · reported by WordfenceMedium 6.4
- Jan 7, 2025User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2024-12738 · affects up to 3.12.9 · reported by WordfenceMedium 6.1
- Jul 29, 2024User Profile Builder: Does not have proper authorisationCVE-2024-6366 · fixed in 3.11.8 · reported by WPScan29% oddsCritical 9.1
- May 17, 2024Profile Builder: Insufficient Verification of Data AuthenticityCVE-2024-31341 · affects up to 3.11.2 · reported by PatchstackMedium 5.3
- Feb 5, 2024User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Unauthorized modification of dataCVE-2024-0324 · affects up to 3.10.8 · reported by Wordfence2.4% oddsHigh 8.2
- Jan 11, 2024User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Unauthorized access of dataCVE-2023-6504 · affects up to 3.10.7 · reported by WordfenceMedium 4.3
- Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin CVE-2023-47669 · fixed in 3.10.4 · reported by PatchstackMedium 5.4
- Sep 4, 2023Profile Builder: Lacks authorisation and CSRF in its page creation functionCVE-2023-4059 · fixed in 3.9.8 · reported by WPScanMedium 4.3
- Apr 26, 2023Profile Builder – User Profile & User Registration Forms: Unauthorized password resetsCVE-2023-2297 · affects up to 3.9.0 · reported by WordfenceCritical 9.8
- Feb 13, 2023Profile Builder – User Profile & User Registration Forms: Sensitive information disclosureCVE-2023-0814 · affects up to 3.9.0 · reported by WordfenceMedium 6.5
- Oct 11, 2022Cozmoslabs Profile Builder plugin <= 3.6.0 at: Cross-Site Request Forgery (CSRF)CVE-2021-36915 · affects up to 3.6.0 · reported by PatchstackMedium 4.2
- Apr 4, 2022Profile Builder: Does not sanitise and escape Form Fields titles and descriptionCVE-2022-0884 · fixed in 3.6.8 · reported by WPScanMedium 4.8
- Feb 24, 2022Profile Builder – User Profile & User Registration Forms: Cross-Site ScriptingCVE-2022-0653 · affects up to 3.6.1 · reported by Wordfence2.3% oddsMedium 6.1
- Aug 16, 2021User Registration & User Profile – Profile Builder: Has a bug allowing any user to reset the password of the admin of the blogCVE-2021-24527 · fixed in 3.4.9 · reported by WPScan8.9% oddsCritical 9.8
- Aug 2, 2021User Registration & User Profile – Profile Builder: Does not sanitise or escape its 'Modify default Redirect Delay timer' settingCVE-2021-24448 · fixed in 3.4.8 · reported by WPScanMedium 4.8
- Aug 22, 2019The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.CVE-2015-9337 · fixed in 2.1.4 · reported by MITRE1.3% oddsHigh 7.5
- Aug 21, 2019The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.CVE-2016-10911 · fixed in 2.4.2 · reported by MITREMedium 6.1
- Aug 21, 2019The profile-builder plugin before 2.2.5 for WordPress has XSS.CVE-2015-9328 · fixed in 2.2.5 · reported by MITREMedium 6.1
- Aug 21, 2019The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.CVE-2014-10380 · fixed in 1.1.66 · reported by MITREMedium 6.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.