Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: User Profile Builder 4.0.5 Clear all filters
TI-2026-79570 CVE-2026-111982 · GHSA-qgfq-45qj-365w

Account takeover in User Profile Builder through email change

Priority LOW 34

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00334 Published 2026-10-23 Fixed in 4.0.5 CWE-269
TI-2026-79569 CVE-2026-111966 · GHSA-9mx2-qxwc-rp6q

Stored cross-site scripting in User Profile Builder plugin

Priority LOW 32

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contribut…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00306 Published 2026-10-23 Fixed in 4.0.5 CWE-79