Plugin icon

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

profile-builder

Vulnerabilities:

34

Last Updated:

March 13, 2026

Active Installs:

50000

Published
Title
Fixed in
CVSS
Published
2026-03-30
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.15.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
Fixed in
Fixed in 3.15.6
CVSS
4.3 (medium)
Published
2026-01-12
Title
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
Fixed in
Fixed in 3.15.2
CVSS
9.8 (critical)
Published
2025-11-18
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.14.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.14.9
CVSS
6.4 (medium)
Published
2025-08-15
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.14.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.14.4
CVSS
6.4 (medium)
Published
2025-06-05
Title
Profile Builder < 3.13.9 - Unauthenticated Content Spoofing
Fixed in
Fixed in 3.13.9
CVSS
5.3 (medium)
Published
2025-06-02
Title
Profile Builder < 3.13.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
Fixed in
Fixed in 3.13.9
CVSS
6.4 (medium)
Published
2025-04-15
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.13.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 3.13.7
CVSS
6.4 (medium)
Published
2025-01-06
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.13.0 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.13.0
CVSS
6.1 (medium)
Published
2024-07-10
Title
Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting
Fixed in
Fixed in 3.12.2
CVSS
3.5 (low)
Published
2024-07-10
Title
profile-builder < 3.11.9 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 3.11.9
CVSS
9.8 (critical)
Published
2024-07-08
Title
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
Fixed in
Fixed in 3.11.8
CVSS
5.3 (medium)
Published
2024-04-05
Title
Profile Builder < 3.11.3 - Restricted Email Bypass
Fixed in
Fixed in 3.11.3
CVSS
5.3 (medium)
Published
2024-01-16
Title
User Profile Builder < 3.10.9 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
Fixed in
Fixed in 3.10.9
CVSS
8.2 (high)
Published
2024-01-05
Title
Profile Builder < 3.10.8 - Contributor+ User Metadata Disclosure
Fixed in
Fixed in 3.10.8
CVSS
4.3 (medium)
Published
2023-11-07
Title
Profile Builder < 3.10.4 - Plugins Activation/Deactivation CSRF
Fixed in
Fixed in 3.10.4
CVSS
5.4 (medium)
Published
2023-08-09
Title
Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation
Fixed in
Fixed in 3.9.8
CVSS
4.3 (medium)
Published
2023-02-13
Title
Profile Builder < 3.9.1 - Subscriber+ Arbitrary User Meta Disclosure
Fixed in
Fixed in 3.9.1
CVSS
5.3 (medium)
Published
2023-02-13
Title
Profile Builder < 3.9.1 - Unauthorised Password Reset
Fixed in
Fixed in 3.9.1
CVSS
8.8 (high)
Published
2022-09-29
Title
Profile Builder < 3.6.1 - Settings Import via CSRF
Fixed in
Fixed in 3.6.1
CVSS
3.1 (low)
Published
2022-03-09
Title
Profile Builder < 3.6.8 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 3.6.8
CVSS
3.4 (low)
Published
2022-02-17
Title
Profile Builder < 3.6.2 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.6.2
CVSS
6.1 (medium)
Published
2021-08-10
Title
Profile Builder < 3.5.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.5.1
CVSS
4.7 (medium)
Published
2021-07-19
Title
Profile Builder < 3.4.9 - Admin Access via Password Reset
Fixed in
Fixed in 3.4.9
CVSS
10.0 (critical)
Published
2021-06-30
Title
Profile Builder < 3.4.8 - Authenticated Stored XSS
Fixed in
Fixed in 3.4.8
CVSS
4.8 (medium)
Published
2020-12-02
Title
Profile Builder & Profile Builder Pro < 3.3.3 - Authenticated Blind SQL Injection
Fixed in
Fixed in 3.3.3
CVSS
6.6 (medium)
Published
2020-02-10
Title
Profile Builder and Profile Builder Pro < 3.1.1 - User Registration With Administrator Role
Fixed in
Fixed in 3.1.1
CVSS
10.0 (critical)
Published
2017-03-10
Title
Profile Builder < 2.5.8 - Authenticated Stored Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.5.8
CVSS
4.8 (medium)
Published
2016-07-13
Title
Profile Builder < 2.4.2 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.4.2
CVSS
6.1 (medium)
Published
2016-07-08
Title
Profile Builder < 2.4.1 - Privilege Escalation
Fixed in
Fixed in 2.4.1
CVSS
8.8 (high)
Published
2015-11-11
Title
Profile Builder < 2.2.5 - XSS
Fixed in
Fixed in 2.2.5
CVSS
6.1 (medium)
Published
2015-04-15
Title
Profile Builder < 2.1.4 - Missing Access Controls
Fixed in
Fixed in 2.1.4
CVSS
7.5 (high)
Published
2014-10-30
Title
Profile Builder < 2.0.3 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.3
CVSS
6.1 (medium)
Published
2014-08-01
Title
Profile Builder < 1.1.60 - Password Recovery Bypass
Fixed in
Fixed in 1.1.60
CVSS
6.5 (medium)
Published
2014-07-16
Title
Profile Builder < 1.1.66 - Multiple XSS
Fixed in
Fixed in 1.1.66
CVSS
6.1 (medium)