VulnCheck KEV: CVE-2026-27413

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a before 3.14.0...

WordPress Profile Builder Pro PHP object injection detection

Detects Profile Builder Pro = 3.14.5 unauthenticated PHP object injection via wppbrequestuserspins admin-ajax args parameter. Optionally sends a safe stdClass probe; HTTP 500 indicates deserialization of attacker input. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Tuple...

WordPress Profile Builder Pro <= 3.14.5 - PHP Object Injection RCE

Unauthenticated PHP object injection in Profile Builder Pro via the wppbrequestuserspins admin-ajax action args parameter. Full RCE requires a POP gadget chain; this module chains The Events Calendar Monolog ProcessHandler Monolog/RCE10 when that plugin is present. !/usr/bin/env python3 -- coding...

EUVD-2026-37608

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385 WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385 WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385

The CVE concerns WordPress Profile Builder Pro plugin, versions ≤ 3.15.0, with an Unauthenticated Cross Site Scripting (XSS) vulnerability. The issue affects the plugin’s handling of input in a way that allows an attacker without authentication to inject script resulting in client-side execution....

PT-2026-50327

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-42385: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

WordPress Profile Builder Pro plugin <= 3.14.5 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by 0xbro in WordPress Plugin Profile Builder Pro versions = 3.14.5...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-7647

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

EUVD-2026-26750

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-7647 Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-7647 Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...

CVE-2026-7647

Profile Builder Pro for WordPress (versions up to 3.14.5) is vulnerable to PHP Object Injection due to maybe_unserialize() on the attacker-controlled 'args' parameter in wppb_request_users_pins_action_callback(). The AJAX handler is registered for both authenticated and unauthenticated requests (...

PT-2026-36582

Name of the Vulnerable Software and Affected Versions Profile Builder Pro versions prior to 3.14.6 Description The Profile Builder Pro plugin for WordPress is susceptible to PHP Object Injection. This occurs because the wppb request users pins action callback AJAX handler uses the maybe unseriali...

CVE-2026-7647: Deserialization of Untrusted Data

The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's maybeunserialize function on the attacker-controlled 'args' POST parameter within the wppbrequestuserspinsactioncallback AJAX handler, whi...