Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: User Profile Builder 4.0.1 Clear all filters
TI-2026-53492 CVE-2026-76547 · GHSA-w8mx-gm67-wrqq

Profile Builder < 4.0.1 - Admin+ PHP Object Injection via Import/Export

Priority LOW 31

The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00417 Published 2026-08-29 Fixed in 4.0.1 CWE-502
TI-2026-53491 CVE-2026-76546 · GHSA-ff29-gmhf-78ff

Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode

Priority LOW 30

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00431 Published 2026-08-29 Fixed in 4.0.1 CWE-79