Login Request a demo
UP
Product
User Profile Builder
by · last CVE Oct 23, 2026
11
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 3High 4Medium 4Low 0
Severity
All severities11Critical3High4Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add User Profile Builder to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-15030
9.8
1%
Feb 2
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
Affected: 1.1.27 before 3.15.2
CVE-2024-6695
9.8
1%
Jul 31
profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
Affected: before 3.11.9
CVE-2024-6366
9.1
29%
Jul 29
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
Affected: before 3.11.8
CVE-2026-76548
8.2
0%
Aug 29
Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass
Affected: 3.8.1 before 4.0.1
CVE-2026-15368
8.1
0%
Aug 1
Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
Affected: before 3.16.4
CVE-2026-111982
New
7.2
0%
Oct 23
Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
Affected: before 4.0.5
CVE-2026-111948
7.1
0%
Oct 21
Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
Affected: before 4.0.1
CVE-2026-111966
New
6.8
0%
Oct 23
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
Affected: before 4.0.5
CVE-2026-76546
6.8
0%
Aug 29
Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode
Affected: 3.3.4 before 4.0.1
CVE-2026-76547
6.6
0%
Aug 29
Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export
Affected: 3.3.4 before 4.0.1
CVE-2024-6708
4.8
0%
May 15
Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting
Affected: before 3.12.2
Showing 11