cozmoslabs
Web & CMS Pluginscommercial
Latest CVEs
The 15 most recently published vulnerabilities affecting cozmoslabs.
- CVE-2026-95866User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field7.2
- CVE-2026-93656User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field6.4
- CVE-2026-89412TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel7.2
- CVE-2026-6431User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field7.2
- CVE-2026-75964User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter6.1
- CVE-2026-75965User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute6.4
- CVE-2026-82607Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload7.3
- CVE-2026-76053TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser7.2
- CVE-2026-19632TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure9.8
- CVE-2026-18512TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor6.4
- CVE-2026-78267WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability9.8
- CVE-2026-66582WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2026-75981TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting7.2
- CVE-2026-15826User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter9.8
- CVE-2026-66701WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability5.3