WordPress profile-builder has 17 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-6366 | The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media | critical | 9.1 | <3.11.8 | 3.11.8 |
| CVE-2021-24527 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of th | critical | 9.8 | <3.4.9 | 3.4.9 |
| CVE-2024-0324 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | high | 8.2 | <=3.10.8 | – |
| CVE-2022-0653 | The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient esca | medium | 6.1 | <=3.6.1 | – |
| CVE-2015-9337 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. | high | 7.5 | <2.1.4 | 2.1.4 |
| CVE-2014-8492 | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPres | medium | 6.1 | <=2.0.2 | – |
| CVE-2023-2297 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions | critical | 9.8 | <=3.9.0 | – |
| CVE-2014-10380 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. | medium | 6.1 | <1.1.66 | 1.1.66 |
| CVE-2015-9328 | The profile-builder plugin before 2.2.5 for WordPress has XSS. | medium | 6.1 | <2.2.5 | 2.2.5 |
| CVE-2016-10911 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. | medium | 6.1 | <2.4.2 | 2.4.2 |
| CVE-2023-0814 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the | medium | 6.5 | <=3.9.0 | – |
| CVE-2022-0884 | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high pr | medium | 4.8 | <3.6.8 | 3.6.8 |
| CVE-2021-24448 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirec | medium | 4.8 | <3.4.8 | 3.4.8 |
| CVE-2024-6708 | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the a | medium | 4.8 | <3.12.2 | 3.12.2 |
| CVE-2023-6504 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unautho | medium | 4.3 | <=3.10.7 | – |
| CVE-2021-36915 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file an | medium | 4.2 | <=3.6.0 | – |
| CVE-2023-4059 | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated us | medium | 4.3 | <3.9.8 | 3.9.8 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked