High
CVE-2026-95866
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 53
Reset filters
Medium
CVE-2026-93656
User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
Medium
CVE-2026-96338
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-6431
User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
Medium
CVE-2026-75964
User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
Medium
CVE-2026-75965
User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
Medium
CVE-2026-76548
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Missing Authorization
Medium
CVE-2026-82607
Profile Builder < 3.16.1 - Unauthenticated Limited File Upload
Medium
CVE-2026-76546
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-76547
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection
Critical
CVE-2026-15826
User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
Medium
CVE-2026-66701
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 - Missing Authorization
High
CVE-2026-15368
Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover
High
CVE-2026-7647
Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection
High
CVE-2026-42385
Profile Builder Pro <= 3.15.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-3139
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
High
CVE-2026-27413
Profile Builder Pro < 3.14.0 - Unauthenticated SQL Injection
Critical
CVE-2025-15030
User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2025-13054
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-8896
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-49292
Profile Builder <= 3.13.8 - Unauthenticated Content Spoofing
Medium
CVE-2025-4671
Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
Medium
CVE-2025-2314
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-12738
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.