User profile builder – beautiful user registration forms, user profiles & user role editor

This hub aggregates every CVE we track for User profile builder – beautiful user registration forms, user profiles & user role editor, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting User profile builder – beautiful user registration forms, user profiles & user role editor.

• CVE-2026-95866User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field7.2Sep 25, 2026
• CVE-2026-93656User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field6.4Sep 25, 2026
• CVE-2026-6431User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field7.2Sep 7, 2026
• CVE-2026-75964User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter6.1Sep 1, 2026
• CVE-2026-75965User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute6.4Sep 1, 2026
• CVE-2026-15826User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter9.8Aug 15, 2026
• CVE-2026-3139User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field4.3Mar 31, 2026
• CVE-2025-13054User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4Nov 19, 2025
• CVE-2025-8896User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4Aug 16, 2025
• CVE-2025-4671Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes6.4Jun 3, 2025
• CVE-2025-2314User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4Apr 16, 2025
• CVE-2024-12738User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting6.1Jan 7, 2025
• CVE-2024-0324User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update8.2Feb 5, 2024
• CVE-2023-6504Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode4.3Jan 11, 2024
• CVE-2023-47669WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4Nov 13, 2023