The KingComposer WordPress plugin through 2.9.6 does not have authorisation, CSRF and sanitisation/escaping when creating profile, allowing any authenticated users to create arbitrary ones, with Cross-Site Scripting payloads in them
[
{
"product": "Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme",
"vendor": "Unknown",
"versions": [
{
"lessThanOrEqual": "2.9.6",
"status": "affected",
"version": "2.9.6",
"versionType": "custom"
}
]
}
]