VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor security & vulnerabilities

profile-builder— active installsLast vulnerability Nov 11, 2026

No known unpatched vulnerabilities in the latest version

All 59 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
59Known vulnerabilities
  • Critical7
  • High13
  • Medium38
  • Low1
Vulnerabilities per year
2014: 3 vulnerabilities3142015: 2 vulnerabilities2152016: 2 vulnerabilities2162017: 1 vulnerability1172020: 2 vulnerabilities2202021: 2 vulnerabilities2212022: 3 vulnerabilities3222023: 4 vulnerabilities4232024: 6 vulnerabilities6242025: 6 vulnerabilities6252026: 28 vulnerabilities2826

All User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.3Unauthenticated Information Exposure
≤4.0.6Update to 4.0.7
CVE-2026-125777
Medium6.3Authenticated (Contributor+) Privilege Escalation
≤4.0.5Update to 4.0.6
CVE-2026-54854
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.0.5Update to 4.0.6
CVE-2026-54855
Medium5.3Missing Authorization
≤4.0.5Update to 4.0.6
CVE-2026-54853
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<4.0.5Update to 4.0.5
CVE-2026-111966
Low2.7Missing Authorization
<4.0.5Update to 4.0.5
CVE-2026-111982
Medium4.34.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass
4.0.0 – 4.0.4Update to 4.0.5
CVE-2026-111965
High7.1Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
≤4.0.3Update to 4.0.4
CVE-2026-115807
Medium6.3Authenticated (Author+) Privilege Escalation
≤4.0.4Update to 4.0.5
CVE-2026-112242
Medium6.1Reflected Cross-Site Scripting
≤4.0.0Update to 4.0.1
CVE-2026-111948
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
≤4.0.3Update to 4.0.4
CVE-2026-107748
High8.1Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
≤4.0.3Update to 4.0.4
CVE-2026-109447
High7.2Unauthenticated Stored Cross-Site Scripting via First Name Field
≤4.0.3Update to 4.0.4
CVE-2026-100186
High7.2Unauthenticated Stored Cross-Site Scripting via Avatar Field
≤4.0.2Update to 4.0.3
CVE-2026-95866
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
≤4.0.2Update to 4.0.3
CVE-2026-93656
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.0.2Update to 4.0.3
CVE-2026-96338
High7.2Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
≤3.15.7Update to 3.15.8
CVE-2026-6431
Medium6.1Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
≤4.0.0Update to 4.0.1
CVE-2026-75964
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
≤4.0.0Update to 4.0.1
CVE-2026-75965
Medium5.3Missing Authorization
<4.0.1Update to 4.0.1
CVE-2026-76548
Medium5.3Unauthenticated Limited File Upload
≤3.16.1Update to 3.16.2
CVE-2026-82607
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
<4.0.1Update to 4.0.1
CVE-2026-76546
Medium6.6Authenticated (Administrator+) PHP Object Injection
<4.0.1Update to 4.0.1
CVE-2026-76547
Critical9.8Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
≤3.16.4Update to 3.16.5
CVE-2026-15826
Medium5.3Missing Authorization
≤3.16.5Update to 3.16.6
CVE-2026-66701
High7.3Privilege Escalation to Unauthenticated Account Takeover
≤3.16.3Update to 3.16.4
CVE-2026-15368
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
≤3.15.5Update to 3.15.6
CVE-2026-3139
Critical9.8Unauthenticated Privilege Escalation via Account Takeover
≤3.15.1Update to 3.15.2
CVE-2025-15030
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.14.8Update to 3.14.9
CVE-2025-13054
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.14.3Update to 3.14.4
CVE-2025-8896
Medium5.3Unauthenticated Content Spoofing
≤3.13.8Update to 3.13.9
CVE-2025-49292
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
≤3.13.8Update to 3.13.9
CVE-2025-4671
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.13.6Update to 3.13.7
CVE-2025-2314
Medium6.1Unauthenticated Stored Cross-Site Scripting
≤3.12.9Update to 3.13.0
CVE-2024-12738
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.12.1Update to 3.12.2
CVE-2024-6708
Critical9.8Authentication Bypass
≤3.11.8Update to 3.11.9
CVE-2024-6695
Medium5.3Missing Authorization to Unauthenticated Media Upload
≤3.11.7Update to 3.11.8
CVE-2024-6366
Medium5.3Restricted Email Bypass
≤3.11.2Update to 3.11.3
CVE-2024-31341
High8.2Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
≤3.10.8Update to 3.10.9
CVE-2024-0324
Medium4.3Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
≤3.10.6Update to 3.10.8
CVE-2023-6504
High7.1Cross-Site Request Forgery via pms-cross-promotion.php
≤3.10.3Update to 3.10.4
CVE-2023-47669
Medium5.3Missing Authorization to Initial Page Creation
<3.9.8Update to 3.9.8
CVE-2023-4059
Critical9.8Insecure Password Reset Mechanism
≤3.9.0Update to 3.9.1
CVE-2023-2297
Medium6.5Sensitive Information Disclosure via Shortcode
≤3.9.0Update to 3.9.1
CVE-2023-0814
High8.8Cross-Site Request Forgery
≤3.6.4Update to 3.6.5
CVE-2021-36915
Medium5.5Admin+ Stored Cross-Site Scripting
<3.6.8Update to 3.6.8
CVE-2022-0884
Medium6.1User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter
≤3.6.1Update to 3.6.2
CVE-2022-0653
Critical9.8Admin Access via Password Reset
<3.4.9Update to 3.4.9
CVE-2021-24527
Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.4.7Update to 3.4.8
CVE-2021-24448
High8.8Authenticated Blind SQL Injection
<3.3.3Update to 3.3.3
—
Critical9.8Privilege Escalation
<3.1.1Update to 3.1.1
—
Medium5.5Cross-Site Scripting
<2.5.8Update to 2.5.8
—
Medium6.1Cross-Site Scripting
<2.4.2Update to 2.4.2
CVE-2016-10911
High8.8Privilege Escalation
<2.4.1Update to 2.4.1
—
Medium6.1Reflected Cross-Site Scripting
<2.2.5Update to 2.2.5
CVE-2015-9328
High7.5Missing Access Controls
≤2.1.3Update to 2.1.4
CVE-2015-9337
Medium6.1Reflected Cross-Site Scripting
≤2.0.2Update to 2.0.3
CVE-2014-8492
Medium6.1Cross-Site Scripting
<1.1.66Update to 1.1.66
CVE-2014-10380
Critical9.8Authentication Bypass
<1.1.60Update to 1.1.60
—

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: common questions

Does User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor have known vulnerabilities?

Yes. VulnCrest Radar lists 59 known vulnerabilities in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: 7 critical, 13 high, 38 medium, 1 low. None are known to affect version null.

How do I check which version of User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerability?

CVE-2026-125777, published Nov 11, 2026: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.6 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).

Is any User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerability listed in CISA KEV?

No. None of the known User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?