Profile Builder Pro

Profile Builder Pro has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 8 are fixed as of September 2026. Their average CVSS score is 7.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 5 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (25%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).

Every one of the 8 issues recorded for Profile Builder Pro has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (3) reported by Dave Jong.

Strategic Overview

Avg CVSSHigh

7.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Profile Builder Pro vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

Profile Builder <= 3.1.0 - Privilege Escalation

Read the full analysis

Vulnerability Records

8 records


2026-05-01 17:10	Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection Profile Builder Pro <= 3.14.5	`CVE-2026-7647`	8.1 High	0xbro	Yes
2026-04-27 00:00	Profile Builder Pro <= 3.15.0 - Unauthenticated Stored Cross-Site Scripting Profile Builder Pro <= 3.15.0	`CVE-2026-42385`	7.2 High	João Pedro Soares de Alcântara	Yes
2026-02-23 00:00	Profile Builder Pro < 3.14.0 - Unauthenticated SQL Injection Profile Builder Pro < 3.14.0	`CVE-2026-27413`	7.5 High	0xd4rk5id3	Yes
2024-01-10 00:00	Profile Builder Pro <= 3.10.0 - Reflected Cross-Site Scripting Profile Builder Pro <= 3.10.0	`CVE-2024-22142`	6.1 Medium	Dave Jong	Yes
2024-01-10 00:00	Profile Builder Pro <= 3.10.0 - Authenticated (Subscriber+) Time-Based One-Time Password Sensitive Information Exposure Profile Builder Pro <= 3.10.0	`CVE-2024-22141`	6.5 Medium	Dave Jong	Yes
2024-01-10 00:00	Profile Builder Pro <= 3.10.0 - Cross-Site Request Forgery Profile Builder Pro <= 3.10.0	`CVE-2024-22140`	8.8 High	Dave Jong	Yes
2020-12-04 00:00	Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection Profile Builder Pro < 3.3.3	`N/A`	8.8 High	Lenon Leite	Yes
2020-02-13 00:00	Profile Builder <= 3.1.0 - Privilege Escalation Profile Builder Pro < 3.1.1	`N/A`	9.8 Critical	Mikey Veenstra	Yes

Showing 1–8 of 8 reports