EN ES
Start free
Menu

User Profile Builder: known security problems

55 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 55 known security problems on this page. Each one has a fixed version. Updating to version 4.0.5 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 4.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.5
Fixed in
4.0.5
What to do
If your site has an affected version, update User Profile Builder to version 4.0.5 or newer.
Official ID
CVE-2026-111966
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 4.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.5
Fixed in
4.0.5
What to do
If your site has an affected version, update User Profile Builder to version 4.0.5 or newer.
Official ID
CVE-2026-111982
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Missing Authorization
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (from 4.0.0 up to and including 4.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 4.0.0 up to and including 4.0.4
Fixed in
4.0.5
What to do
If your site has an affected version, update User Profile Builder to version 4.0.5 or newer.
Official ID
CVE-2026-111965
Report title
Profile Builder 4.0.0 - 4.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass
First reported
Sources
This week

Someone with an author account on your site could take over your site as an admin (up to and including 4.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.3
Fixed in
4.0.4
What to do
If your site has an affected version, update User Profile Builder to version 4.0.4 or newer.
Official ID
CVE-2026-115807
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
First reported
Sources
This week

Someone with an author account on your site could take over your site as an admin (up to and including 4.0.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.4
Fixed in
4.0.5
What to do
If your site has an affected version, update User Profile Builder to version 4.0.5 or newer.
Official ID
CVE-2026-112242
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.4 - Authenticated (Author+) Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.0
Fixed in
4.0.1
What to do
If your site has an affected version, update User Profile Builder to version 4.0.1 or newer.
Official ID
CVE-2026-111948
Report title
Profile Builder <= 4.0.0 - Reflected Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 4.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.3
Fixed in
4.0.4
What to do
If your site has an affected version, update User Profile Builder to version 4.0.4 or newer.
Official ID
CVE-2026-107748
Report title
User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 4.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.3
Fixed in
4.0.4
What to do
If your site has an affected version, update User Profile Builder to version 4.0.4 or newer.
Official ID
CVE-2026-109447
Report title
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.0.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.3
Fixed in
4.0.4
What to do
If your site has an affected version, update User Profile Builder to version 4.0.4 or newer.
Official ID
CVE-2026-100186
Report title
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.2
Fixed in
4.0.3
What to do
If your site has an affected version, update User Profile Builder to version 4.0.3 or newer.
Official ID
CVE-2026-95866
Report title
User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 4.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.2
Fixed in
4.0.3
What to do
If your site has an affected version, update User Profile Builder to version 4.0.3 or newer.
Official ID
CVE-2026-93656
Report title
User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 4.0.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.2
Fixed in
4.0.3
What to do
If your site has an affected version, update User Profile Builder to version 4.0.3 or newer.
Official ID
CVE-2026-96338
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.7
Fixed in
3.15.8
What to do
If your site has an affected version, update User Profile Builder to version 3.15.8 or newer.
Official ID
CVE-2026-6431
Report title
User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.0
Fixed in
4.0.1
What to do
If your site has an affected version, update User Profile Builder to version 4.0.1 or newer.
Official ID
CVE-2026-75964
Report title
User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.0
Fixed in
4.0.1
What to do
If your site has an affected version, update User Profile Builder to version 4.0.1 or newer.
Official ID
CVE-2026-75965
Report title
User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 4.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.1
Fixed in
4.0.1
What to do
If your site has an affected version, update User Profile Builder to version 4.0.1 or newer.
Official ID
CVE-2026-76548
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Missing Authorization
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.16.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.16.1
Fixed in
3.16.2
What to do
If your site has an affected version, update User Profile Builder to version 3.16.2 or newer.
Official ID
CVE-2026-82607
Report title
Profile Builder < 3.16.1 - Unauthenticated Limited File Upload
First reported
Sources
This week

Someone who already has an admin account could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.1
Fixed in
4.0.1
What to do
If your site has an affected version, update User Profile Builder to version 4.0.1 or newer.
Official ID
CVE-2026-76547
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (before 4.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.1
Fixed in
4.0.1
What to do
If your site has an affected version, update User Profile Builder to version 4.0.1 or newer.
Official ID
CVE-2026-76546
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 3.16.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.16.4
Fixed in
3.16.5
What to do
If your site has an affected version, update User Profile Builder to version 3.16.5 or newer.
Official ID
CVE-2026-15826
Report title
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.16.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.16.5
Fixed in
3.16.6
What to do
If your site has an affected version, update User Profile Builder to version 3.16.6 or newer.
Official ID
CVE-2026-66701
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 - Missing Authorization
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 3.16.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.16.3
Fixed in
3.16.4
What to do
If your site has an affected version, update User Profile Builder to version 3.16.4 or newer.
Official ID
CVE-2026-15368
Report title
Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.15.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.5
Fixed in
3.15.6
What to do
If your site has an affected version, update User Profile Builder to version 3.15.6 or newer.
Official ID
CVE-2026-3139
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
First reported
Sources
This week

A stranger could take over your site as an admin (up to and including 3.15.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.1
Fixed in
3.15.2
What to do
If your site has an affected version, update User Profile Builder to version 3.15.2 or newer.
Official ID
CVE-2025-15030
Report title
User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.14.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.8
Fixed in
3.14.9
What to do
If your site has an affected version, update User Profile Builder to version 3.14.9 or newer.
Official ID
CVE-2025-13054
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 3.14.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.3
Fixed in
3.14.4
What to do
If your site has an affected version, update User Profile Builder to version 3.14.4 or newer.
Official ID
CVE-2025-8896
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.13.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13.8
Fixed in
3.13.9
What to do
If your site has an affected version, update User Profile Builder to version 3.13.9 or newer.
Official ID
CVE-2025-49292
Report title
Profile Builder <= 3.13.8 - Unauthenticated Content Spoofing
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.13.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13.8
Fixed in
3.13.9
What to do
If your site has an affected version, update User Profile Builder to version 3.13.9 or newer.
Official ID
CVE-2025-4671
Report title
Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.13.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13.6
Fixed in
3.13.7
What to do
If your site has an affected version, update User Profile Builder to version 3.13.7 or newer.
Official ID
CVE-2025-2314
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.12.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.12.9
Fixed in
3.13.0
What to do
If your site has an affected version, update User Profile Builder to version 3.13.0 or newer.
Official ID
CVE-2024-12738
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.12.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.12.1
Fixed in
3.12.2
What to do
If your site has an affected version, update User Profile Builder to version 3.12.2 or newer.
Official ID
CVE-2024-6708
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could take over your site as an admin (up to and including 3.11.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.11.8
Fixed in
3.11.9
What to do
If your site has an affected version, update User Profile Builder to version 3.11.9 or newer.
Official ID
CVE-2024-6695
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 - Authentication Bypass
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.11.7
Fixed in
3.11.8
What to do
If your site has an affected version, update User Profile Builder to version 3.11.8 or newer.
Official ID
CVE-2024-6366
Report title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.7 - Missing Authorization to Unauthenticated Media Upload
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.11.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.11.2
Fixed in
3.11.3
What to do
If your site has an affected version, update User Profile Builder to version 3.11.3 or newer.
Official ID
CVE-2024-31341
Report title
Profile Builder <= 3.11.2 - Restricted Email Bypass
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.10.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10.8
Fixed in
3.10.9
What to do
If your site has an affected version, update User Profile Builder to version 3.10.9 or newer.
Official ID
CVE-2024-0324
Report title
User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
First reported
Sources
This week

Someone could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10.6
Fixed in
3.10.8
What to do
If your site has an affected version, update User Profile Builder to version 3.10.8 or newer.
Official ID
CVE-2023-6504
Report title
Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.10.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10.3
Fixed in
3.10.4
What to do
If your site has an affected version, update User Profile Builder to version 3.10.4 or newer.
Official ID
CVE-2023-47669
Report title
Profile Builder <= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 3.9.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.9.8
Fixed in
3.9.8
What to do
If your site has an affected version, update User Profile Builder to version 3.9.8 or newer.
Official ID
CVE-2023-4059
Report title
Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.9.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.0
Fixed in
3.9.1
What to do
If your site has an affected version, update User Profile Builder to version 3.9.1 or newer.
Official ID
CVE-2023-0814
Report title
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.9.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.0
Fixed in
3.9.1
What to do
If your site has an affected version, update User Profile Builder to version 3.9.1 or newer.
Official ID
CVE-2023-2297
Report title
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.4
Fixed in
3.6.5
What to do
If your site has an affected version, update User Profile Builder to version 3.6.5 or newer.
Official ID
CVE-2021-36915
Report title
Profile Builder – User Profile & User Registration Forms <= 3.6.4 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.6.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.6.8
Fixed in
3.6.8
What to do
If your site has an affected version, update User Profile Builder to version 3.6.8 or newer.
Official ID
CVE-2022-0884
Report title
Profile Builder <= 3.6.7 - Admin+ Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.1
Fixed in
3.6.2
What to do
If your site has an affected version, update User Profile Builder to version 3.6.2 or newer.
Official ID
CVE-2022-0653
Report title
Profile Builder - User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter
First reported
Sources
This week

Someone could use it to harm your site (before 3.4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.9
Fixed in
3.4.9
What to do
If your site has an affected version, update User Profile Builder to version 3.4.9 or newer.
Official ID
CVE-2021-24527
Report title
Profile Builder <= 3.4.8 - Admin Access via Password Reset
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.4.7
Fixed in
3.4.8
What to do
If your site has an affected version, update User Profile Builder to version 3.4.8 or newer.
Official ID
CVE-2021-24448
Report title
Profile Builder <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.3.3
Fixed in
3.3.3
What to do
If your site has an affected version, update User Profile Builder to version 3.3.3 or newer.
Report title
Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection
First reported
Sources
This week

Someone could take over your site as an admin (before 3.1.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.1.1
Fixed in
3.1.1
What to do
If your site has an affected version, update User Profile Builder to version 3.1.1 or newer.
Report title
Profile Builder <= 3.1.0 - Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.5.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.5.8
Fixed in
2.5.8
What to do
If your site has an affected version, update User Profile Builder to version 2.5.8 or newer.
Report title
Profile Builder < 2.5.8 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.4.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.4.2
Fixed in
2.4.2
What to do
If your site has an affected version, update User Profile Builder to version 2.4.2 or newer.
Official ID
CVE-2016-10911
Report title
Profile Builder – User Profile & User Registration Forms < 2.4.2 - Cross-Site Scripting
First reported
Sources
This week

Someone could take over your site as an admin (before 2.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.4.1
Fixed in
2.4.1
What to do
If your site has an affected version, update User Profile Builder to version 2.4.1 or newer.
Report title
Profile Builder <= 2.4.0 - Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.2.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.2.5
Fixed in
2.2.5
What to do
If your site has an affected version, update User Profile Builder to version 2.2.5 or newer.
Official ID
CVE-2015-9328
Report title
Profile Builder – User Profile & User Registration Forms <= 2.2.4 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.1.3
Fixed in
2.1.4
What to do
If your site has an affected version, update User Profile Builder to version 2.1.4 or newer.
Official ID
CVE-2015-9337
Report title
Profile Builder <= 2.1.3 - Missing Access Controls
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.2
Fixed in
2.0.3
What to do
If your site has an affected version, update User Profile Builder to version 2.0.3 or newer.
Official ID
CVE-2014-8492
Report title
Profile Builder <= 2.0.2 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.1.66)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.1.66
Fixed in
1.1.66
What to do
If your site has an affected version, update User Profile Builder to version 1.1.66 or newer.
Official ID
CVE-2014-10380
Report title
Profile Builder – User Profile & User Registration Forms < 1.1.66 - Cross-Site Scripting
First reported
Sources
This week

Someone could take over your site as an admin (before 1.1.60)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.1.60
Fixed in
1.1.60
What to do
If your site has an affected version, update User Profile Builder to version 1.1.60 or newer.
Report title
Profile Builder – User Profile & User Registration Forms Plugin < 1.1.60 - Authentication Bypass
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)