Profile Builder
Cozmoslabs
Developer
4.0.2
Latest version
40,000
Installations
No date
Last updated
Vulnerability history
0 present
37 patched
16 Mitigation rules
- Unauthenticated Limited File Upload vulnerability<= 3.16.13 hours ago
- Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability<= 3.15.708/09/2026
- Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability<= 4.0.031/08/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute vulnerability<= 4.0.031/08/2026
- Unauthenticated Unpublished Content and Media Modification vulnerability< 4.0.131/08/2026
- Contributor+ Stored XSS vulnerability< 4.0.129/08/2026
- Admin+ PHP Object Injection vulnerability< 4.0.129/08/2026
- Unauthenticated Account Takeover vulnerability< 3.16.418/08/2026
- Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter vulnerability<= 3.16.417/08/2026
- Broken Access Control vulnerability<= 3.16.529/07/2026
- WordPress User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor plugin <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field vulnerability<= 3.15.531/03/2026
- Unauthenticated Arbitrary Password Reset vulnerability< 3.15.203/02/2026
- Unauthenticated Privilege Escalation vulnerability< 3.11.930/01/2026
- Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability<= 3.14.818/11/2025
- Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability<= 3.14.316/08/2025
- Content Spoofing Vulnerability<= 3.13.805/06/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes vulnerability<= 3.13.803/06/2025
- Admin+ Stored Cross Site Scripting vulnerability<= 3.12.019/05/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability<= 3.13.615/04/2025
- Unauthenticated Stored Cross-Site Scripting vulnerability<= 3.12.907/01/2025
- Unauthenticated Media Upload vulnerability< 3.11.829/07/2024
- Bypass Vulnerability vulnerability<= 3.11.205/04/2024
- Missing Authorization to Plugin Settings Change vulnerability<= 3.10.816/01/2024
- Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode vulnerability<= 3.10.708/01/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 3.10.308/11/2023
- Missing Authorization to Initial Page Creation vulnerability< 3.9.809/08/2023
- Insecure Password Reset Mechanism vulnerability<= 3.9.027/04/2023
- Sensitive Information Disclosure via Shortcode vulnerability<= 3.9.014/02/2023
- Cross-Site Request Forgery (CSRF) vulnerability<= 3.6.029/09/2022
- Stored Cross-Site Scripting (XSS) vulnerability<= 3.6.709/03/2022
- Reflected Cross-Site Scripting (XSS) vulnerability<= 3.6.117/02/2022
- Authenticated Stored Cross-Site Scripting (XSS) vulnerability<= 3.4.730/06/2021
- Authenticated Blind SQL Injection (SQLi) vulnerability<= 3.3.202/12/2020
- User Registration With Administrator Role vulnerability<= 3.1.010/02/2020
- Reflected Cross Site Scripting<= 2.4.113/07/2016
- Privilege Escalation<= 2.4.008/07/2016
- BYPASS<= 1.1.5901/08/2014