Advisories · Technology
cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor.
Every CVE that names cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Privilege escalation
- CVSS 7.2 High
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 8.1 High
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Privilege escalation
- CVSS 6.4 Medium
User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 7.2 High
User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 7.2 High
User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- CWE-704
- CVSS 4.3 Medium
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignme…
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Broken access control
- CVSS 6.4 Medium
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 8.2 High
User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Broken access control
- CVSS 4.3 Medium
Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Broken access control
- CVSS 5.4 Medium
WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)
- Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site request forgery (CSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- CWE-620
- CVSS 6.5 Medium
Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Information disclosure