CVE-2025-15030

CVE-2025-15030 User Profile Builder 3.15.2 - 未認証の任意パスワードリセット CVE-2025-15030 User Profile Builder — 未認証のパスワードリセット → 管理者権限奪取 + シェルアップロード root@kitploit: / / \ |/ / / / / / \ / / / \ / \ | / | | //| \ / /| / | / /| \ | || | / | / || / | | | // | /\/ /| /|/ /\ |\| |\ || /| \ || /|...

User Profile Builder 3.16.4 - Unauthenticated Authentication Bypass

The User Profile Builder plugin for WordPress version 3.16.4 is vulnerable to an authentication bypass via type confusion. Profile Builder's automatic-login-after-registration handler passes the return value of wpinsertuser through absint before testing it with iswperror, so the error check runs...

Profile Builder < 3.4.9 - Improper Authentication

The Profile Builder plugin before 3.4.9 for WordPress allows unauthenticated attackers to gain administrative access by exploiting an improper authentication vulnerability in the password reset functionality. An attacker can reset the password of any user, including administrators, without proper...

User Profile Builder < 3.11.8 - File Upload

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP. id: CVE-2024-6366 info: name: User Profile Builder 3.11.8 - File Upload author: s4e-io severity: high...

CVE-2024-6366-PoC

CVE-2024-6366-PoC User Profile Builder = 3.11.7 - 認証されていないメディアアップロード 説明 User Profile Builder WordPressプラグイン（バージョン3.11.8未満）は適切な認可を行っておらず、WPの非同期アップロード機能を介して認証されていないユーザーがメディアファイルをアップロードできるようになっています。 使用方法: root@kitploit: usage: CVE-2024-6366.py -h -u URL The User Profile Builder WordPress plugin befo...

CVE-2024-6366

バージョン3.11.8未満のUser Profile Builder WordPressプラグインのRCE脆弱性を悪用するMetasploitモジュールを作成するには、メディアファイルのアップロード機能における適切な認可の欠如を利用する必要があります。以下に、そのようなMetasploitモジュールを作成する方法を示します。 Metasploitモジュール 以下のコードをwordpressuserprofilebuilderrce.rbとして、Metasploit Frameworkインストール先のmodules/exploits/unix/webappディレクトリに保存してください。...

WordPress User Profile Builder plugin <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability

Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field vulnerability discovered by daroo in WordPress Plugin Profile Builder versions = 3.15.7...

CVE-2026-6431

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

EUVD-2026-72367

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-6431

CVE-2026-6431 affects the User Profile Builder WordPress plugin (all versions up to and including 3.15.7 ), which is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) through the 'Biographical Info' meta field parameter. The root cause is insufficient input sanitization and output e...

PT-2026-86756

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and...

CVE-2026-75964

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75964 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75964

CVE-2026-75964 affects the User Profile Builder WordPress plugin in all versions up to and including 4.0.0 . The vulnerability is a Stored Cross-Site Scripting (XSS) in the 'email' parameter of the email-confirmation feature, caused by insufficient input sanitization and output escaping. An unaut...

EUVD-2026-68985

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75965

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

EUVD-2026-68972

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...

CVE-2026-75965

The User Profile Builder WordPress plugin (versions ≤ 4.0.0 ) is vulnerable to Stored Cross-Site Scripting via the 'date' Shortcode Attribute , caused by insufficient input sanitization and output escaping in the format-date shortcode. Authenticated users with contributor-level access or higher c...

CVE-2026-75965 User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...