User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities

Product

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

by cozmoslabs · last CVE Oct 24, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities19 In the news0 Timeline

Severity mix

Critical 1High 7Medium 11Low 0

Severity

All severities19 Critical1 High7 Medium11 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-47669	8.8	0%	Nov 13	WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 3.10.3
CVE-2026-109447	8.1	0%	Oct 16	User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] Affected: through 4.0.3
CVE-2024-0324	7.5	2%	Feb 5	User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update Affected: through 3.10.8
CVE-2026-100186	7.2	0%	Oct 16	User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field Affected: through 4.0.3
CVE-2026-95866	7.2	0%	Sep 25	User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field Affected: through 4.0.2
CVE-2026-6431	7.2	0%	Sep 7	User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field Affected: through 3.15.7
CVE-2026-115807 New	7.1	0%	Oct 24	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute Affected: through 4.0.3