Advisories · Technology
User Profile Builder.
Every CVE that names User Profile Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.2 High
Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
- User Profile Builder
- Privilege escalation
- CVSS 6.8 Medium
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
- User Profile Builder
- Cross-site scripting (XSS)
- CVSS 7.1 High
Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
- User Profile Builder
- Cross-site scripting (XSS)
- CVSS 8.2 High
Profile Builder < 4.0.1 - Unauthenticated Unpublished Content and Media Modification via Front-End Upload Auth Bypass
- User Profile Builder
- Authentication bypass
- CVSS 6.6 Medium
Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export
- User Profile Builder
- Insecure deserialization
- CVSS 6.8 Medium
Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode
- User Profile Builder
- Cross-site scripting (XSS)
- CVSS 8.1 High
Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
- User Profile Builder
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
- User Profile Builder
- Privilege escalation
- CVSS 4.8 Medium
Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting
- User Profile Builder
- CVSS 9.8 CriticalCritical · CVSS 9+
profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
- User Profile Builder
- CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
- User Profile Builder