Product by Cozmoslabs

    User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

    21 known vulnerabilities in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (Cozmoslabs), 0 of them actively exploited (CISA KEV).

    Key figures

    21

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (Cozmoslabs)
    CriticalCVE-2026-15826

    Incorrect Type Conversion or Cast (CVE-2026-15826)

    		9.8
    HighCVE-2024-0324

    Cozmoslabs Profile Builder: Improper Access Control

    also in 1 other product

    		8.2
    CriticalCVE-2023-2297

    Cozmoslabs Profile Builder: Unverified Password Change

    also in 1 other product

    		9.8
    HighCVE-2026-109447

    Improper Privilege Management (CVE-2026-109447)

    		8.1
    HighCVE-2026-6431

    Cross-site Scripting (CVE-2026-6431)

    		7.2
    HighCVE-2026-100186

    User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field

    		7.2
    HighCVE-2026-115807

    Improper Privilege Management (CVE-2026-115807)

    		7.1
    HighCVE-2026-95866

    User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field

    		7.2
    MediumCVE-2026-107748

    Cross-site Scripting (CVE-2026-107748)

    		6.4
    MediumCVE-2026-75964

    User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

    		6.1
    MediumCVE-2026-75965

    Cross-site Scripting (CVE-2026-75965)

    		6.4
    MediumCVE-2023-0814

    Cozmoslabs Profile Builder: Exposure of Sensitive Information to an Unauthorized Actor

    also in 1 other product

    		6.5
    MediumCVE-2026-93656

    Cross-site Scripting (CVE-2026-93656)

    		6.4
    MediumCVE-2024-12738

    Cross-site Scripting (CVE-2024-12738)

    		6.1
    MediumCVE-2025-2314

    Cross-site Scripting (CVE-2025-2314)

    		6.4
    MediumCVE-2025-4671

    Cross-site Scripting (CVE-2025-4671)

    		6.4
    MediumCVE-2025-13054

    Cross-site Scripting (CVE-2025-13054)

    		6.4
    MediumCVE-2025-8896

    Cross-site Scripting (CVE-2025-8896)

    		6.4
    MediumCVE-2026-3139

    Authorization Bypass Through User-Controlled Key (CVE-2026-3139)

    		4.3
    HighCVE-2023-47669

    WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)

    also in 1 other product

    		5.4
    MediumCVE-2023-6504

    Cozmoslabs Profile Builder: Authorization Bypass Through User-Controlled Key

    also in 1 other product

    		4.3

    All products by Cozmoslabs