User Profile Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:user_profile_builder:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | User Profile Builder (46cb8e16-f448-5f2e-99ef-2365ef0c44d5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111948 |
vulnerable | 2026-11-03 10:16:11.065735 |
Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
Published: 2026-10-21T06:00:22.778Z
Updated: 2026-10-21T10:35:03.409Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111982 |
vulnerable | 2026-11-03 10:16:10.903060 |
Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.
Published: 2026-10-23T06:00:19.393Z
Updated: 2026-10-23T10:46:04.193Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111966 |
vulnerable | 2026-11-03 10:16:10.682223 |
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.
Published: 2026-10-23T06:00:19.223Z
Updated: 2026-10-23T10:46:04.366Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15368 |
vulnerable | 2026-09-16 04:33:06.827210 |
Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration
The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
Published: 2026-08-01T06:00:09.399Z
Updated: 2026-08-05T16:19:28.543Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-15030 |
vulnerable | 2026-06-08 07:06:35.577318 |
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
Published: 2026-02-02T06:00:01.885Z
Updated: 2026-02-02T15:14:11.302Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6708 |
vulnerable | 2026-06-08 06:58:20.216563 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6695 |
vulnerable | 2026-06-08 06:58:20.183560 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6366 |
vulnerable | 2026-06-08 06:58:18.773372 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.