User Profile Builder
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:user_profile_builder:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | User Profile Builder (46cb8e16-f448-5f2e-99ef-2365ef0c44d5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-15030 |
vulnerable | 2026-06-08 07:06:35.577318 |
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
Published: 2026-02-02T06:00:01.885Z
Updated: 2026-02-02T15:14:11.302Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6708 |
vulnerable | 2026-06-08 06:58:20.216563 |
Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting
The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which allows Admin+ users to perform Cross-Site Scripting attacks.
Published: 2025-05-15T20:07:09.159Z
Updated: 2025-05-20T19:23:48.654Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6695 |
vulnerable | 2026-06-08 06:58:20.183560 |
profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
Published: 2024-07-31T06:00:04.649Z
Updated: 2024-07-31T15:06:31.038Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6366 |
vulnerable | 2026-06-08 06:58:18.773372 |
User Profile Builder < 3.11.8 - Unauthenticated Media Upload
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
Published: 2024-07-29T06:00:08.248Z
Updated: 2024-08-01T21:33:05.436Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.