CVE-2026-6431User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 09/07/2026 Severity High CVE-2026-75964User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 09/01/2026 Severity Medium CVE-2026-75965User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 09/01/2026 Severity Medium CVE-2026-82607Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload Exploitation status Public exploit Fix Affected product P Profile Builder Plugin Published 08/31/2026 Severity Medium CVE-2026-76053TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser Exploitation status Not known exploited Fix Affected product T TranslatePress – Translate Multilingual sites with AI Translation Published 08/28/2026 Severity High CVE-2026-19632TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure Exploitation status Not known exploited Fix Affected product T TranslatePress – Translate Multilingual sites with AI Translation Published 08/26/2026 Severity Critical CVE-2026-18512TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor Exploitation status Not known exploited Fix Affected product T TranslatePress – Translate Multilingual sites with AI Translation Published 08/25/2026 Severity Medium CVE-2026-78267WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product T TranslatePress Published 08/24/2026 Severity Critical CVE-2026-66582WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product T TranslatePress Published 08/20/2026 Severity High CVE-2026-75981TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T TranslatePress – Translate Multilingual sites with AI Translation Published 08/19/2026 Severity High CVE-2026-15826User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 08/15/2026 Severity Critical CVE-2026-66701WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Profile Builder Published 08/06/2026 Severity Medium CVE-2026-18510TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content Exploitation status Not known exploited Fix Affected product T TranslatePress – Translate Multilingual sites with AI Translation Published 08/06/2026 Severity High CVE-2026-17505TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T TranslatePress – Translate Multilingual sites with AI Translation Published 08/05/2026 Severity Medium CVE-2026-59539WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 07/27/2026 Severity High CVE-2026-61971WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product U User Profile Picture Published 07/13/2026 Severity Low CVE-2026-57348WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 07/02/2026 Severity High CVE-2026-42385WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P Profile Builder Pro Published 06/17/2026 Severity High CVE-2026-39514WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 06/15/2026 Severity High CVE-2026-7647Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection Exploitation status Not known exploited Fix Affected product P Profile Builder Pro Published 05/02/2026 Severity High CVE-2026-3139User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 03/31/2026 Severity Medium CVE-2026-27413WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product P Profile Builder Pro Published 03/19/2026 Severity Critical CVE-2025-68514WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 02/20/2026 Severity Medium CVE-2025-66074WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product W WP Webhooks Published 12/18/2025 Severity Critical CVE-2025-66073WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product W WP Webhooks Published 11/21/2025 Severity High CVE-2025-13054User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 11/19/2025 Severity Medium CVE-2025-58592WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability Exploitation status Not known exploited Fix Affected product T TranslatePress Published 11/06/2025 Severity High CVE-2025-11835Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal Exploitation status Not known exploited Fix Affected product P Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Published 11/05/2025 Severity Medium CVE-2025-58600WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 09/03/2025 Severity Medium CVE-2025-8895WP Webhooks <= 3.3.5 - Unauthenticated Arbitrary File Copy Exploitation status Not known exploited Fix Affected product W WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress Published 08/21/2025 Severity Critical CVE-2025-54017WordPress Paid Member Subscriptions <= 2.15.4 - Local File Inclusion Vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 08/20/2025 Severity High CVE-2025-8896User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 08/16/2025 Severity Medium CVE-2025-49870WordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection Vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 07/04/2025 Severity High CVE-2025-49292WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability Exploitation status Not known exploited Fix Affected product P Profile Builder Published 06/06/2025 Severity Medium CVE-2025-4671Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 06/03/2025 Severity Medium CVE-2024-6708Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting Exploitation status Public exploit Fix Affected product U User Profile Builder Published 05/15/2025 Severity Medium CVE-2025-2314User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 04/16/2025 Severity Medium CVE-2025-31088WordPress Paid Member Subscriptions plugin <= 2.14.3 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 03/28/2025 Severity Medium CVE-2025-30773WordPress TranslatePress plugin <= 2.9.6 - PHP Object Injection Vulnerability Exploitation status Not known exploited Fix Affected product T TranslatePress Published 03/27/2025 Severity High CVE-2024-12919Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id Exploitation status Not known exploited Fix Affected product P Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Published 01/14/2025 Severity Critical CVE-2024-12738User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 01/07/2025 Severity Medium CVE-2024-11291Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product P Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Published 12/18/2024 Severity Medium CVE-2024-10261Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution Exploitation status Not known exploited Fix Affected product P Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Published 11/09/2024 Severity High CVE-2024-9222Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product P Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Published 10/02/2024 Severity Medium CVE-2024-6695profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation Exploitation status Public exploit Fix Affected product U User Profile Builder Published 07/31/2024 Severity Critical CVE-2024-6366User Profile Builder < 3.11.8 - Unauthenticated Media Upload Exploitation status Public exploit Fix Affected product U User Profile Builder Published 07/29/2024 Severity Critical CVE-2024-5639User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update Exploitation status Not known exploited Fix Affected product U User Profile Picture Published 06/21/2024 Severity Medium CVE-2024-31341WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerability Exploitation status Not known exploited Fix Affected product P Profile Builder Published 05/17/2024 Severity Medium CVE-2024-32728WordPress Paid Membership Subscriptions plugin <= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 04/24/2024 Severity Medium CVE-2023-51522WordPress Paid Membership Subscriptions plugin <= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product P Paid Member Subscriptions Published 03/15/2024 Severity Medium CVE-2024-1389Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return Exploitation status Not known exploited Fix Affected product P Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Published 02/20/2024 Severity Medium CVE-2024-1390Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page Exploitation status Not known exploited Fix Affected product P Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Published 02/20/2024 Severity Medium CVE-2024-0324User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 02/05/2024 Severity High CVE-2024-22140WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product P Profile Builder Pro Published 01/31/2024 Severity High CVE-2024-22141WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure Exploitation status Not known exploited Fix Affected product P Profile Builder Pro Published 01/24/2024 Severity Medium CVE-2024-22142WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product P Profile Builder Pro Published 01/12/2024 Severity High CVE-2023-6504Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 01/11/2024 Severity Medium CVE-2023-47669WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 11/13/2023 Severity Medium CVE-2023-4059Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation Exploitation status Public exploit Fix Affected product P Profile Builder Published 09/04/2023 Severity Medium CVE-2023-2297Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 04/26/2023 Severity Critical CVE-2023-25968WordPress Client Portal – Private user pages and login Plugin <= 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product C Client Portal – Private user pages and login Published 03/15/2023 Severity Medium CVE-2023-0814Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode Exploitation status Not known exploited Fix Affected product U User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Published 02/14/2023 Severity Medium CVE-2022-4442WCK < 2.3.3 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product C Custom Post Types and Custom Fields creator Published 01/16/2023 Severity Medium CVE-2021-36915WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product P Profile Builder – User Profile & User Registration Forms (WordPress plugin) Published 10/11/2022 Severity Medium CVE-2022-3141Translatepress Multilinugal < 2.3.3 - Admin+ SQLi Exploitation status Not confirmed Fix Affected product T Translate Multilingual sites – TranslatePress Published 09/19/2022 Severity Unknown CVE-2022-0884Profile Builder < 3.6.8 - Admin+ Stored Cross-Site Scripting Exploitation status Not confirmed Fix Affected product P Profile Builder – User Profile & User Registration Forms Published 04/04/2022 Severity Unknown CVE-2022-0653Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product P Profile Builder – User Profile & User Registration Forms Published 02/24/2022 Severity Medium CVE-2021-24610TranslatePress < 2.0.9 - Authenticated Stored Cross-Site Scripting Exploitation status Not confirmed Fix Affected product T Translate Multilingual sites – TranslatePress Published 09/27/2021 Severity Unknown CVE-2021-24728Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection Exploitation status Not confirmed Fix Affected product M Membership & Content Restriction – Paid Member Subscriptions Published 09/13/2021 Severity Unknown CVE-2021-24527Profile Builder < 3.4.9 - Admin Access via Password Reset Exploitation status Not confirmed Fix Affected product U User Registration & User Profile – Profile Builder Published 08/16/2021 Severity Unknown CVE-2021-24473User Profile Picture < 2.6.0 - Arbitrary User Picture Change/Deletion via IDOR Exploitation status Not confirmed Fix Affected product U User Profile Picture Published 08/02/2021 Severity Unknown CVE-2021-24448Profile Builder < 3.4.8 - Authenticated Stored XSS Exploitation status Not confirmed Fix Affected product U User Registration & User Profile – Profile Builder Published 08/02/2021 Severity Unknown CVE-2021-24170User Profile Picture < 2.5.0 - Sensitive Information Disclosure Exploitation status Not confirmed Fix Affected product U User Profile Picture Published 04/05/2021 Severity Unknown CVE-2015-9337Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/22/2019 Severity Unknown CVE-2016-10911Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/21/2019 Severity Unknown CVE-2015-9328Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/21/2019 Severity Unknown CVE-2014-10380Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 08/21/2019 Severity Unknown CVE-2014-8492Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 10/06/2017 Severity Unknown 
.svg){kind=icon}
