Cozmoslabs
- Total products in the ecosystem
- 13
- Total vulnerabilities (90 days)
- 33
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, Cozmoslabs recorded 33 security vulnerabilities in the last 90 days across 6 products, including 20 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor had the most security vulnerabilities in the Cozmoslabs ecosystem, with 10 vulnerabilities—approximately 30.3% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121765WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-120537TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary EndpointCVE-2026-119523WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerabilityCVE-2026-119167TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack BypassCVE-2026-119521WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-121765WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes |
| Published11/07/2026 |
| SeverityHigh |
CVE-2026-120537TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-119523WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-119167TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass | Exploitation statusNot confirmed | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published11/07/2026 | SeverityHigh |
|---|
CVE-2026-119521WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot confirmed | FixYes | Affected productPaid Member Subscriptions | Published11/03/2026 | SeverityMedium |
|---|
CVE-2026-54855WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder | Published10/30/2026 | SeverityHigh |
|---|
CVE-2026-54854WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder | Published10/30/2026 | SeverityMedium |
|---|
CVE-2026-54853WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-115807User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published10/24/2026 | SeverityHigh |
|---|
CVE-2026-112842WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published10/22/2026 | SeverityMedium |
|---|
CVE-2026-112242WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder | Published10/22/2026 | SeverityHigh |
|---|
CVE-2026-109447User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published10/16/2026 | SeverityHigh |
|---|
CVE-2026-107768TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published10/16/2026 | SeverityHigh |
|---|
CVE-2026-107748User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published10/16/2026 | SeverityMedium |
|---|
CVE-2026-100186User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published10/16/2026 | SeverityHigh |
|---|
CVE-2026-105317WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published10/06/2026 | SeverityHigh |
|---|
CVE-2026-103062WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productTranslatePress | Published10/04/2026 | SeverityHigh |
|---|
CVE-2026-97249WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published09/30/2026 | SeverityMedium |
|---|
CVE-2026-96338WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder | Published09/30/2026 | SeverityMedium |
|---|
CVE-2026-95866User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published09/25/2026 | SeverityHigh |
|---|
CVE-2026-93656User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published09/25/2026 | SeverityMedium |
|---|
CVE-2026-89412TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published09/22/2026 | SeverityHigh |
|---|
CVE-2026-6431User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published09/07/2026 | SeverityHigh |
|---|
CVE-2026-75965User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published09/01/2026 | SeverityMedium |
|---|
CVE-2026-75964User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published09/01/2026 | SeverityMedium |
|---|
CVE-2026-82607Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload | Exploitation statusActively exploited | FixYes | Affected productProfile Builder Plugin | Published08/31/2026 | SeverityMedium |
|---|
CVE-2026-76053TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published08/28/2026 | SeverityHigh |
|---|
CVE-2026-19632TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published08/26/2026 | SeverityCritical |
|---|
CVE-2026-18512TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-78267WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability | Exploitation statusNot exploited | FixYes | Affected productTranslatePress | Published08/24/2026 | SeverityCritical |
|---|
CVE-2026-66582Unauthenticated cross-site scripting in Cozmoslabs TranslatePress | Exploitation statusNot exploited | FixYes | Affected productTranslatePress | Published08/20/2026 | SeverityHigh |
|---|
CVE-2026-75981TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-15826User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published08/15/2026 | SeverityCritical |
|---|
CVE-2026-66701WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder | Published08/06/2026 | SeverityMedium |
|---|
CVE-2026-18510TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published08/06/2026 | SeverityHigh |
|---|
CVE-2026-17505TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productTranslatePress – Translate Multilingual sites with AI Translation | Published08/05/2026 | SeverityMedium |
|---|
CVE-2026-59539WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published07/27/2026 | SeverityHigh |
|---|
CVE-2026-61971User-controlled key authorization bypass in Cozmoslabs User Profile Picture | Exploitation statusNot exploited | FixYes | Affected productUser Profile Picture | Published07/13/2026 | SeverityLow |
|---|
CVE-2026-57348WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published07/02/2026 | SeverityHigh |
|---|
CVE-2026-42385WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder Pro | Published06/17/2026 | SeverityHigh |
|---|
CVE-2026-39514WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published06/15/2026 | SeverityHigh |
|---|
CVE-2026-7647Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection | Exploitation statusNot exploited | FixYes | Affected productProfile Builder Pro | Published05/02/2026 | SeverityHigh |
|---|
CVE-2026-3139User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published03/31/2026 | SeverityMedium |
|---|
CVE-2026-27413WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productProfile Builder Pro | Published03/19/2026 | SeverityCritical |
|---|
CVE-2025-68514WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productPaid Member Subscriptions | Published02/20/2026 | SeverityMedium |
|---|
CVE-2025-66074WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Webhooks | Published12/18/2025 | SeverityCritical |
|---|
CVE-2025-66073WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Webhooks | Published11/21/2025 | SeverityHigh |
|---|
CVE-2025-13054User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | Exploitation statusNot exploited | FixYes | Affected productUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Published11/19/2025 | SeverityMedium |
|---|
CVE-2025-58592WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability | Exploitation statusNot exploited | FixYes | Affected productTranslatePress | Published11/06/2025 | SeverityHigh |
|---|
CVE-2025-11835Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal | Exploitation statusNot exploited | FixYes | Affected productPaid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | Published11/05/2025 | SeverityMedium |
|---|
81 Results | Page 1 of 2