Vulnerabilities / User Profile Builder
User Profile Builder vulnerabilities
Advisories WPSec published for User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor. Other sources may list more. Its attack surface: User Profile Builder on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-14 | WPSEC-2026-0892 | User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via Signup Details on Unconfirmed Emails List | Medium 4.7 | 4.0.4 |
| 2026-10-14 | WPSEC-2026-0891 | User Profile Builder <= 4.0.3 - Authenticated (Author+) Privilege Escalation via Register Block and Elementor Widget | High 8.8 | 4.0.4 |
| 2026-10-14 | WPSEC-2026-0890 | User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via 'role' Custom Field on Registration with Email Confirmation | High 8.1 | 4.0.4 |
| 2026-10-14 | WPSEC-2026-0889 | User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Avatar Image | Medium 6.4 | 4.0.4 |
| 2026-10-14 | WPSEC-2026-0888 | User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via Select (User Role) Field | High 8.1 | 4.0.4 |
License: CC BY 4.0