User Profile Builder (Unknown) - vulnerabilities (CVEs)
11 CVEs, 3 in the last 30 days, 2 known versions, newest CVE from 2026-10-23. Vendor: Unknown.
CVEs of User Profile Builder
- CVE-2026-111966 - CVSS 6.8 (medium), 2026-10-23: The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect…
- CVE-2026-111982 - CVSS 7.2 (high), 2026-10-23: The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit…
- CVE-2026-111948 - CVSS 7.1 (high), 2026-10-21: The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin…
- CVE-2026-76546 - CVSS 6.8 (medium), 2026-08-29: The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as…
- CVE-2026-76548 - CVSS 8.2 (high), 2026-08-29: The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors…
- CVE-2026-76547 - CVSS 6.6 (medium), 2026-08-29: The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing…
- CVE-2026-15368 - CVSS 8.1 (high), 2026-08-01: The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created…
- CVE-2025-15030 - CVSS 9.8 (critical), 2026-02-02: The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the…
- CVE-2024-6708 - CVSS 4.8 (medium), 2025-05-15: The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which…
- CVE-2024-6695 - CVSS 9.8 (critical), 2024-07-31: it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is…
- CVE-2024-6366 - CVSS 9.1 (critical), 2024-07-29: The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async…
