User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

Explore User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities across all versions. Currently tracking 33 known vulnerabilities, including severity, impact, and patch status.

01234567891013.04.2011Today06.05.20149.8Profile Builder – User Profile & User Registration Forms Plugin < 1.1.60 - Authentication Bypass CVSS 9.8 · 06.05.201416.07.20146.1Profile Builder – User Profile & User Registration Forms < 1.1.66 - Cross-Site Scripting CVSS 6.1 · 16.07.201430.10.20146.1Profile Builder <= 2.0.2 - Reflected Cross-Site Scripting CVSS 6.1 · 30.10.201415.04.20157.5Profile Builder <= 2.1.3 - Missing Access Controls CVSS 7.5 · 15.04.201511.11.20156.1Profile Builder – User Profile & User Registration Forms <= 2.2.4 - Reflected Cross-Site Scripting CVSS 6.1 · 11.11.201507.07.20168.8Profile Builder <= 2.4.0 - Privilege Escalation CVSS 8.8 · 07.07.201613.07.20166.1Profile Builder – User Profile & User Registration Forms < 2.4.2 - Cross-Site Scripting CVSS 6.1 · 13.07.201610.03.20175.5Profile Builder < 2.5.8 - Cross-Site Scripting CVSS 5.5 · 10.03.201713.02.20209.8Profile Builder <= 3.1.0 - Privilege Escalation CVSS 9.8 · 13.02.202004.12.20208.8Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection CVSS 8.8 · 04.12.202030.06.20215.5Profile Builder <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting CVSS 5.5 · 30.06.202119.07.20219.8Profile Builder <= 3.4.8 - Admin Access via Password Reset CVSS 9.8 · 19.07.202117.02.20226.1Profile Builder - User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter CVSS 6.1 · 17.02.202209.03.20225.5Profile Builder <= 3.6.7 - Admin+ Stored Cross-Site Scripting CVSS 5.5 · 09.03.202229.09.20228.8Profile Builder – User Profile & User Registration Forms <= 3.6.4 - Cross-Site Request Forgery CVSS 8.8 · 29.09.202213.02.20239.8Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism CVSS 9.8 · 13.02.20236.5Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode CVSS 6.5 · 13.02.202308.08.20235.3Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation CVSS 5.3 · 08.08.202307.11.20237.1Profile Builder <= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php CVSS 7.1 · 07.11.202305.01.20244.3Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode CVSS 4.3 · 05.01.202416.01.20248.2User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update CVSS 8.2 · 16.01.202405.04.20245.3Profile Builder <= 3.11.2 - Restricted Email Bypass CVSS 5.3 · 05.04.202408.07.20245.3User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.7 - Missing Authorization to Unauthenticated Media Upload CVSS 5.3 · 08.07.202410.07.20249.8User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 - Authentication Bypass CVSS 9.8 · 10.07.202413.08.20244.4User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 4.4 · 13.08.202406.01.20256.1User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting CVSS 6.1 · 06.01.202515.04.20256.4User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 15.04.202502.06.20256.4Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes CVSS 6.4 · 02.06.202505.06.20255.3Profile Builder <= 3.13.8 - Unauthenticated Content Spoofing CVSS 5.3 · 05.06.202515.08.20256.4User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVSS 6.4 · 15.08.202518.11.20256.4User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVSS 6.4 · 18.11.202512.01.20269.8User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover CVSS 9.8 · 12.01.202630.03.20264.3User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field CVSS 4.3 · 30.03.2026

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

33

Get automatic notifications for all User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor vulnerabilities before they are exploited.

Vulnerability Records

33 records
2026-03-30 21:39CVE-2026-3139
4.3
Medium
type5afeYes
2026-01-12 00:00CVE-2025-15030
9.8
Critical
Drew Webber (mcdruid)Yes
2025-11-18 16:29CVE-2025-13054
6.4
Medium
Muhammad Yudha - DJYes
2025-08-15 18:31CVE-2025-8896
6.4
Medium
AlexYes
2025-06-05 00:00CVE-2025-49292
5.3
Medium
Trương Hữu Phúc (truonghuuphuc)Yes
2025-06-02 21:31CVE-2025-4671
6.4
Medium
Muhammad Yudha - DJYes
2025-04-15 12:34CVE-2025-2314
6.4
Medium
Muhammad Yudha - DJYes
2025-01-06 00:00CVE-2024-12738
6.1
Medium
Brian MungaiYes
2024-08-13 00:00CVE-2024-6708
4.4
Medium
John CastroYes
2024-07-10 00:00CVE-2024-6695
9.8
Critical
John CastroYes
Showing 1–10 of 33 reports
User Profile Builder &#8211; Beautiful User Registration Forms, User Profiles &amp; User Role Editor banner
Latestv3.16.6

User Profile Builder &#8211; Beautiful User Registration Forms, User Profiles &amp; User Role Editor

Cozmoslabs

Author

Cozmoslabs

4.7(734)
94/100
Last Updated
2026-07-28 (2d ago)
Active Installs
40,000+
Downloads
5,639,208
Requires WP
3.1+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2011-04-13 (16y ago)

Profile Builder is the all in one user profile and user registration plugin for WordPress. Elegant and reliable user registration and user profile plugin for creating front-end user registration, login and edit profile forms with custom fields. It also lets you restrict content based on user role or logged in status and manage user roles and capabilities using the built in Role Editor. Elevate your user experience and boost sign-ups with beautiful GDPR-compliant registration and login forms, customized user profiles, and all the user management tools you need in one robust solution. Free Demo | Compare Free vs Pro | Documentation Professionally Designed Login and Registration Forms Personalize your website by incorporating front-end user login and user registration forms, providing users with a convenient way of signing up or accessing their profiles. This is ideal for: * Online Communities & Associations * Online Courses * News and Resource Websites Modern and Elegant User Profiles, Listings, and Directories From creating user profiles and a member directory to listing job offers or your community services, Profile Builder gives you the tools you need to monitor your users, control how and where they log in, as well as implement security measures to protect all those involved. This is ideal for: * Business Directory * Member Directory * Job Boards * Consultancy Services Lock Your WooCommerce Shop and Content for Members Only Take control of user access throughout your website, define users’ viewing permissions, and regulate their ability to purchase your products. You can do this based on user role or logged-in status, and you can also manage user roles and capabilities using the built-in role editor. This is ideal for: * Private Websites * Private Content * Private WooCommerce Stores * Members-Only WooCommerce Stores How to Add User Registration, Login, User Profile and Password Recovery Forms You can use the following shortcode list or available plugin blocks to quickly display the user forms on your website: [wppb-register] – to register users via a front-end register form that you can customize with . [wppb-edit-profile] – to grant users front-end access to their user profile (requires user to be logged in). [wppb-login] – to add a front-end login form. [wppb-logout] – to add logout functionality. [wppb-recover-password] – to add a password recovery form. [wppb-restrict] Content to restrict [/wppb-restrict] – to restrict content of any type Profile Builder Features drag & drop to reorder user profile fields add Avatar Upload field for users to manage their avatar on your website enable Email Confirmation (on registration users will receive a notification to confirm their email address) Email Customizer – Personalize all emails sent to your users or admins; customize default WordPress registration email choose between login with only Username, Email or both enforce WordPress password requirements by setting up a minimum password length and minimum password strength (using the default WordPress password strength meter) assign users a specific role at registration (using [wppb-register role=”desired_role”] shortcode argument for the register form) redirect users after login, register and edit-profile using redirect_url shortcode argument ( e.g [wppb-login redirect_url=”www.example.com”] ) add register and lost password links below the login form (using [wppb-login register_url=”www.example.com” lostpassword_url=”www.example.com”] shortcode arguments) customizable user login widget add a custom stylesheet/inherit values from the current theme or use the default one built into this plugin Admin Bar Settings: choose which user roles view the admin bar in the front-end extended functionality available via Add-ons Roles Editor: add, edit, remove or clone user roles and capabilities reCAPTCHA support for Profile Builder and WordPress default forms User Role Select field on register and edit profile forms Content Restriction: restrict content based on current users role or logged in status Restrict WooCommerce shop page and products Restrict Gutenberg blocks Invisible reCAPTCHA support for both Profile Builder forms as well as default WordPress forms Private Website: setup a WordPress private site that is visible only to members or logged in users GDPR: collect users consent about the data you collect about them under the new GDPR law requirements Form Designs: enable beautiful designs for your forms fully customizable by you PROFILE BUILDER PRO The Pro version has the following extra features: Create Extra User Fields (Hidden Input, Agree to Terms Checkbox WYSIWYG, Upload fields, International Telephone Input, User Role Select, Country Select, Timezone Select Upload, Map, HTML, Phone, Datepicker, Timepicker, Colorpicker, Custom Validation field, Currency Select, CPT Select, Taxonomy Select) Support for Conditional Fields Use AJAX for form processing Front-end User Listing (create fully customizable member directories, sorting included) Create Multiple User Listings Custom Redirects Multiple Registration Forms (set up multiple registration forms with different profile fields for certain user roles) Multiple Edit Profile Forms Repeater Fields – add repeater fields or groups of fields to your user profile Admin Approval (approve new users from dashboard or via email) Create a Map of Users Locations Add progress bars to your Edit Profile and Registration forms 17 Premium Add-ons (e.g. custom redirects, user listing, multiple registration forms etc.) Access to Premium Support and Documentation 1 Year of Plugin Updates, New Features and Priority Support Find out more about Profile Builder PRO Add-ons For more functionality check out Profile Builder Add-ons page Free Add-ons GDPR Communication Preferences – allows your users to give consent on the communication preferences Custom Login Page Templates – customize the default WordPress login page with your own design. Client Portal – create private pages for your website users that only an administrator can edit. Custom CSS Classes on Fields – add custom CSS classes for fields Import and Export – allows you to import and export all Profile Builder Settings data Passwordless Login – allow your users to login without a password Maximum Character Length – set a maximum character length for custom input or textarea fields Labels Edit – easily edit all Profile Builder labels Premium Add-ons Form Fields in Columns – create beautiful and responsive custom form layouts by placing different fields on the same row WooCommerce Sync – integrates Profile Builder with WooCommerce, allowing you to manage Shipping and Billing fields from WooCommerce with PB and more Social Connect – enable social login on your website, users can login with Facebook, Google, Twitter(X) or LinkedIn. Multi-Step Forms – allow users to build multi-step forms for Registration and Edit Profile forms. Custom Profile Menus – add custom menu items like Login/Logout or just Logout button and Login/Register/Edit Profile in iFrame Popup Field Visibility – select which user profile fields are visible in the frontend MailChimp – allow users to subscribe to your Mailchimp lists directly from the Register or Edit Profile forms Campaign Monitor – allow users to subscribe to your Campaign Monitor lists directly from the Register or Edit Profile forms MailPoet – allow users to subscribe to your MailPoet lists directly from the Register and Edit Profile forms bbPress – allows you to integrate Profile Builder with the popular forums plugin, bbPress. BuddyPress – allows extending BuddyPress user profiles with Profile Builder user fields. The Ultimate Membership Bundle Combine user registration, memberships, and recurring revenue in one powerful plugin bundle called the Ultimate Membership Bundle. Get access to Profile Builder Pro and Paid Member Subscriptions Pro together. These two plugins are designed to work perfectly together, offering you a powerful toolkit for managing and expanding your user base while generating revenue through paid memberships and recurring revenue. Documentation Please visit the documentation page for this plugin Website For more details visit our website Profile Builder in your Language We’re focusing on translating Profile Builder in as many languages as we can. So far, the translations for 17 languages are almost complete, but we still need help on a lot of other languages, so please join us at translate.wordpress.org You will be able to download all the available language packs as well as help us translate Profile Builder in your language. For more information please visit cozmoslabs.com NOTE: This plugin adds/removes user fields in the front-end. Both default and extra profile fields will be visible in the back-end as well. External Services If you opt in, the plugin sends limited diagnostic and configuration data to Cozmoslabs.com to help improve the product. Terms & Conditions: https://www.cozmoslabs.com/terms-conditions/ Privacy Policy: https://www.cozmoslabs.com/privacy-policy/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C