Extension WordPress
Vulnérabilités User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Cette page rassemble les failles publiées pour User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
33 fiches
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 – Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to…
*-3.15.5
3.15.6
30/03/2026
User Profile Builder <= 3.15.1 – Unauthenticated Privilege Escalation via Account Takeover
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.15.1. This is due to…
*-3.15.1
3.15.2
12/01/2026
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due…
*-3.14.8
3.14.9
18/11/2025
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 – Authenticated (Subscriber+) Stored Cross-Site Scripting
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to…
*-3.14.3
3.14.4
15/08/2025
Profile Builder <= 3.13.8 – Unauthenticated Content Spoofing
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Content Spoofing in all versions up to, and including, 3.13.8. This makes it possible for unauthenticated attackers…
*-3.13.8
3.13.9
05/06/2025
Profile Builder <= 3.13.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied…
*-3.13.8
3.13.9
02/06/2025
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to…
*-3.13.6
3.13.7
15/04/2025
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 – Unauthenticated Stored Cross-Site Scripting
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due…
*-3.12.9
3.13.0
06/01/2025
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.1 – Authenticated (Admin+) Stored Cross-Site Scripting
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.12.1 due to insufficient…
*-3.12.1
3.12.2
13/08/2024
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 – Authentication Bypass
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.11.8. This is due to the plugin not…
*-3.11.8
3.11.9
10/07/2024
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.7 – Missing Authorization to Unauthenticated Media Upload
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized file uplloads due to a missing capability check on the wppb_upload_file_type() function in all versions up…
*-3.11.7
3.11.8
08/07/2024
Profile Builder <= 3.11.2 – Restricted Email Bypass
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to restricted email domain bypass in all versions up to, and including, 3.11.2. This makes it possible for…
*-3.11.2
3.11.3
05/04/2024
User Profile Builder <= 3.10.8 – Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions…
*-3.10.8
3.10.9
16/01/2024
Profile Builder <= 3.10.7 – Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions…
*-3.10.6
3.10.8
05/01/2024
Profile Builder <= 3.10.3 – Cross-Site Request Forgery via pms-cross-promotion.php
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.10.3. This is due to missing or…
*-3.10.3
3.10.4
07/11/2023
Profile Builder <= 3.9.7 – Missing Authorization to Initial Page Creation
The Profile Builder plugin for WordPress is vulnerable to unauthorized page creation due to a missing capability check on the wppb_create_form_pages() function called via an admin_init action in versions up to, and including, 3.9.7. This makes it possible…
[*, 3.9.8)
3.9.8
08/08/2023
Profile Builder – User Profile & User Registration Forms <= 3.9.0 – Insecure Password Reset Mechanism
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with…
*-3.9.0
3.9.1
13/02/2023
Profile Builder – User Profile & User Registration Forms <= 3.9.0 – Sensitive Information Disclosure via Shortcode
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive…
*-3.9.0
3.9.1
13/02/2023
Profile Builder – User Profile & User Registration Forms <= 3.6.4 – Cross-Site Request Forgery
The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.4. This is due to missing nonce validation on the wppb_pbie_import() & wppb_pbie_export_our_json()…
*-3.6.4
3.6.5
29/09/2022
Profile Builder <= 3.6.7 – Admin+ Stored Cross-Site Scripting
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
[*, 3.6.8)
3.6.8
09/03/2022
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.