PB
Product
Profile Builder
28
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 3High 7Medium 18Low 0
Watch
Add Profile Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6695 | 9.8 | Jul 31 | profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation Affected: before 3.11.9 |
| CVE-2021-24527 | 9.8 | Aug 16 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain… Affected: before 3.4.9 |
| CVE-2024-6366 | 9.1 | Jul 29 | User Profile Builder < 3.11.8 - Unauthenticated Media Upload Affected: before 3.11.8 |
| CVE-2026-112242 | 8.8 | Oct 22 | WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability Affected: through 4.0.4 |
| CVE-2024-22140 | 8.8 | Jan 31 | WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 3.10.0 |
| CVE-2023-47669 | 8.8 | Nov 13 | WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF) Affected: before 3.10.4 |
| CVE-2023-2297 | 8.1 | Apr 27 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0 Affected: through 3.9.0 |
| CVE-2024-0324 | 7.5 | Feb 5 | User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update Affected: through 3.10.8 |
| CVE-2024-22141 | 7.5 | Jan 24 | WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure Affected: through 3.10.0 |
| CVE-2015-9337 | 7.5 | Aug 22 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX Affected: before 2.1.4 |
| CVE-2026-96338 | 6.5 | Sep 30 | WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability Affected: through 4.0.2 |
| CVE-2023-0814 | 6.5 | Feb 14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up… Affected: through 3.9.0 |
| CVE-2024-22142 | 6.1 | Jan 12 | WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS) Affected: through 3.10.0 |
| CVE-2022-0653 | 6.1 | Feb 24 | The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url… Affected: through 3.6.1 |
| CVE-2016-10911 | 6.1 | Aug 21 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues Affected: before 2.4.2 |
| CVE-2015-9328 | 6.1 | Aug 21 | The profile-builder plugin before 2.2.5 for WordPress has XSS Affected: before 2.2.5 |
| CVE-2014-10380 | 6.1 | Aug 21 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms Affected: before 1.1.66 |
| CVE-2014-8492 | 6.1 | Oct 6 | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject… Affected: through 2.0.2 |
| CVE-2026-54853 New | 5.3 | Oct 29 | WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability Affected: through 4.0.5 |
| CVE-2026-66701 | 5.3 | Aug 6 | WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability Affected: through 3.16.5 |
| CVE-2024-31341 | 5.3 | May 17 | WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerability Affected: through 3.11.2 |
| CVE-2024-6708 | 4.8 | May 15 | Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting Affected: before 3.12.2 |
| CVE-2022-0884 | 4.8 | Apr 4 | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform… Affected: before 3.6.8 |
| CVE-2021-24448 | 4.8 | Aug 2 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high… Affected: before 3.4.8 |
| CVE-2025-49292 | 4.3 | Jun 6 | WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability Affected: through 3.13.8 |
| CVE-2023-6504 | 4.3 | Jan 11 | Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode Affected: through 3.10.7 |
| CVE-2023-4059 | 4.3 | Sep 4 | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and… Affected: before 3.9.8 |
| CVE-2021-36915 | 4.3 | Oct 11 | WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability Affected: through 3.6.0 |
Showing 28