WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
profile-builder
Published
2021-08-10
Title
Profile Builder < 3.5.1 - Reflected Cross-Site Scripting
Slug
profile-builder
Published
2022-09-29
Title
Profile Builder < 3.6.1 - Settings Import via CSRF
Slug
profile-builder
Published
2023-02-13
Title
Profile Builder < 3.9.1 - Subscriber+ Arbitrary User Meta Disclosure
Slug
profile-builder
Published
2023-02-13
Title
Profile Builder < 3.9.1 - Unauthorised Password Reset
Slug
profile-builder
Published
2023-08-09
Title
Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation
Slug
profile-builder
Published
2023-11-07
Title
Profile Builder < 3.10.4 - Plugins Activation/Deactivation CSRF
Slug
profile-builder
Published
2024-01-05
Title
Profile Builder < 3.10.8 - Contributor+ User Metadata Disclosure
Slug
profile-builder
Published
2024-01-16
Title
User Profile Builder < 3.10.9 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
Slug
profile-builder
Published
2024-04-05
Title
Profile Builder < 3.11.3 - Restricted Email Bypass
Slug
profile-builder
Published
2024-07-08
Title
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
Slug
profile-builder
Published
2024-07-10
Title
profile-builder < 3.11.9 - Unauthenticated Privilege Escalation
Slug
profile-builder
Published
2024-07-10
Title
Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting
Slug
profile-builder
Published
2025-01-06
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.13.0 - Unauthenticated Stored Cross-Site Scripting
Slug
profile-builder
Published
2025-04-15
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.13.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
profile-builder
Published
2025-06-02
Title
Profile Builder < 3.13.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
Slug
profile-builder
Published
2025-06-05
Title
Profile Builder < 3.13.9 - Unauthenticated Content Spoofing
Slug
profile-builder
Published
2025-08-15
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.14.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Slug
profile-builder
Published
2025-11-18
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.14.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Slug
profile-builder
Published
2026-01-12
Title
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
Slug
profile-builder
Published
2026-03-30
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.15.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
Slug
profile-builder
Published
2026-07-17
Title
Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
Slug
profile-builder
Published
2026-07-29
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.16.6 - Missing Authorization
Slug
profile-builder
Published
2026-08-14
Title
User Profile Builder < 3.16.5 - Unauthenticated Administrator Account Takeover via Auto-Login Type Confusion
Slug
profile-builder
Published
2026-09-06
Title
User Profile Builder < 3.15.8 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
Slug
profile-builder
Published
2026-08-27
Title
Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export