User Profile Builder

WordPress plugin · user-profile-builder · WordPress.org ↗

Critical

High

Known total

Unfixed

Running User Profile Builder on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change CVE.org	>=0, <4.0.5	v4.0.5	CVE-2026-111982	Oct 23, 2026
HIGH CVSS 7.1	Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions CVE.org	>=0, <4.0.1	v4.0.1	CVE-2026-111948	Oct 21, 2026
HIGH CVSS 8.2	Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass CVE.org	>=3.8.1, <4.0.1	v4.0.1	CVE-2026-76548	Aug 29, 2026
HIGH CVSS 8.1	Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration CVE.org	>=0, <3.16.4	v3.16.4	CVE-2026-15368	Aug 1, 2026
MEDIUM CVSS 6.8	Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute CVE.org	>=0, <4.0.5	v4.0.5	CVE-2026-111966	Oct 23, 2026
MEDIUM CVSS 6.8	Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode CVE.org	>=3.3.4, <4.0.1	v4.0.1	CVE-2026-76546	Aug 29, 2026
MEDIUM CVSS 6.6	Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export CVE.org	>=3.3.4, <4.0.1	v4.0.1	CVE-2026-76547	Aug 29, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.