user_profile_builder vulnerabilities
CVEs whose affected-version data names the user_profile_builder package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-111966Medium· 6.8Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform St…
CVE-2026-111982High· 7.2Profile Builder < 4.0.5 - Multisite Subsite Admin+ Network Super Admin Account Takeover via Edit Profile Email Change
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any ot…
CVE-2026-111948High· 7.1Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.