WordPress plugin
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 59 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical7
- High13
- Medium38
- Low1
All User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.0.5Update to 4.0.6
- High7.1Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
≤4.0.3Update to 4.0.4
- High8.1Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
≤4.0.3Update to 4.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via First Name Field
≤4.0.3Update to 4.0.4
- High7.2Unauthenticated Stored Cross-Site Scripting via Avatar Field
≤4.0.2Update to 4.0.3
- High7.2Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
≤3.15.7Update to 3.15.8
- Critical9.8Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
≤3.16.4Update to 3.16.5
- High7.3Privilege Escalation to Unauthenticated Account Takeover
≤3.16.3Update to 3.16.4
- Critical9.8Unauthenticated Privilege Escalation via Account Takeover
≤3.15.1Update to 3.15.2
- Critical9.8Authentication Bypass
≤3.11.8Update to 3.11.9
- High8.2Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
≤3.10.8Update to 3.10.9
- High7.1Cross-Site Request Forgery via pms-cross-promotion.php
≤3.10.3Update to 3.10.4
- Critical9.8Insecure Password Reset Mechanism
≤3.9.0Update to 3.9.1
- High8.8Cross-Site Request Forgery
≤3.6.4Update to 3.6.5
- Critical9.8Admin Access via Password Reset
<3.4.9Update to 3.4.9
- High8.8Authenticated Blind SQL Injection
<3.3.3Update to 3.3.3
- Critical9.8Privilege Escalation
<3.1.1Update to 3.1.1
- High8.8Privilege Escalation
<2.4.1Update to 2.4.1
- High7.5Missing Access Controls
≤2.1.3Update to 2.1.4
- Critical9.8Authentication Bypass
<1.1.60Update to 1.1.60
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: common questions
Does User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor have known vulnerabilities?
Yes. VulnCrest Radar lists 59 known vulnerabilities in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: 7 critical, 13 high, 38 medium, 1 low. None are known to affect version null.
How do I check which version of User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerability?
CVE-2026-125777, published Nov 11, 2026: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.6 - Unauthenticated Information Exposure. Severity: Medium (CVSS 5.3).
Is any User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerability listed in CISA KEV?
No. None of the known User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities is currently listed in the CISA KEV catalog.