User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

Vulnerabilities

• CVE-2026-15826

  User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter

  Critical 9.8

• CVE-2023-47669

  WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)

  High 8.8

• CVE-2023-2297

  Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism

  High 8.1

• CVE-2015-9337

  The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

  High 7.5

• CVE-2026-95866

  User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field

  High 7.2

• CVE-2026-6431

  User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

  High 7.2

• CVE-2026-96338

  WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2023-0814

  Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode

  Medium 6.5

• CVE-2026-93656

  User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field

  Medium 6.4

• CVE-2026-75965

  User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute

  Medium 6.4

• CVE-2025-13054

  User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2025-8896

  User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2025-4671

  Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes

  Medium 6.4

• CVE-2025-2314

  User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 6.4

• CVE-2026-75964

  User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

  Medium 6.1

• CVE-2024-12738

  User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

  Medium 6.1

• CVE-2022-0653

  Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting

  Medium 6.1

• CVE-2016-10911

  The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.

  Medium 6.1

• CVE-2015-9328

  The profile-builder plugin before 2.2.5 for WordPress has XSS.

  Medium 6.1

• CVE-2014-10380

  The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.

  Medium 6.1

• CVE-2026-66701

  WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2024-31341

  WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerability

  Medium 5.3

• CVE-2026-3139

  User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscr

  Medium 4.3

• CVE-2025-49292

  WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability

  Medium 4.3

• CVE-2023-6504

  Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode

  Medium 4.3

• CVE-2021-36915

  WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability

  Medium 4.3