Cozmoslabs Profile Builder

Profile Builder < 3.4.9 - Admin Access via Password Reset

Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism

profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation

User Profile Builder < 3.11.8 - Unauthenticated Media Upload

WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF)

WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)

User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure

WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)

Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode

Profile Builder – User Profile & User Registration Forms <= 3.6.1 Reflected Cross-Site Scripting

Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3) site_url parameter.

The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.

The profile-builder plugin before 2.2.5 for WordPress has XSS.

The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.

Profile Builder < 3.6.8 - Admin+ Stored Cross-Site Scripting

Profile Builder < 3.4.8 - Authenticated Stored XSS

Profile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting

Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode

WordPress Profile Builder plugin <= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability

Profile Builder < 3.9.8 - Unauthenticated Plugin's Pages Creation