← WordPress Vulnerabilities
WordPress security by component

Profile Builder

Profile Builder is a WordPress component with 23 published CVE records in this archive. The latest tracked vulnerability was published Jun 06, 2025; the highest CVE/CNA score is 9.8.

Plugin slug: profile-builder

CVE-2025-49292: Profile Builder: A security weakness

Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

PublishedJun 06, 2025
Safe version guidanceSee mitigation notes
Safe version
Jun 06, 2025 CVE-2025-49292
Profile Builder: A security weakness
Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Jun 03, 2025 CVE-2025-4671
Profile Builder: Cross-site scripting
Profile Builder is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVDPending
May 15, 2025 CVE-2024-6708
User Profile Builder: Cross-site scripting
User Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVDPending
Apr 16, 2025 CVE-2025-2314
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Cross-site scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVDPending
Jan 07, 2025 CVE-2024-12738
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Cross-site scripting
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVDPending
Jul 29, 2024 CVE-2024-6366
User Profile Builder: A security weakness
User Profile Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE9.1
NVDPending
May 17, 2024 CVE-2024-31341
Profile Builder: A security weakness
Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Feb 05, 2024 CVE-2024-0324
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: A security weakness
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE8.2
NVD7.5
Jan 11, 2024 CVE-2023-6504
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Sensitive information exposure
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by sensitive information exposure. Exploitation requires at least contributor-level access. Successful exploitation can disclose data that should not be available to the caller.
See mitigation notes
CVE4.3
NVD4.3
Nov 13, 2023 CVE-2023-47669
Profile Builder: Cross-site request forgery
Profile Builder is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE5.4
NVD8.8
Sep 04, 2023 CVE-2023-4059
Profile Builder: Cross-site request forgery
Profile Builder is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.3
NVD4.3
Apr 27, 2023 CVE-2023-2297
Profile Builder – User Profile & User Registration Forms: SQL injection
Profile Builder – User Profile & User Registration Forms is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE9.8
NVD8.1
Feb 14, 2023 CVE-2023-0814
Profile Builder – User Profile & User Registration Forms: Sensitive information exposure
Profile Builder – User Profile & User Registration Forms is affected by sensitive information exposure. Exploitation requires an authenticated WordPress account. Successful exploitation can disclose data that should not be available to the caller.
See mitigation notes
CVE6.5
NVD6.5
Oct 11, 2022 CVE-2021-36915
Profile Builder: Cross-site request forgery
Profile Builder is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.2
NVD4.3
Apr 04, 2022 CVE-2022-0884
Profile Builder: A security weakness
Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.8
NVD4.8
Feb 24, 2022 CVE-2022-0653
Profile Builder – User Profile & User Registration Forms: Cross-site scripting
Profile Builder – User Profile & User Registration Forms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Aug 16, 2021 CVE-2021-24527
User Registration & User Profile – Profile Builder: A security weakness
User Registration & User Profile – Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE9.8
NVD9.8
Aug 02, 2021 CVE-2021-24448
User Registration & User Profile – Profile Builder: Cross-site scripting
User Registration & User Profile – Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVD4.8
Aug 22, 2019 CVE-2015-9337
Profile Builder: A security weakness
Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE7.5
NVD7.5
Aug 21, 2019 CVE-2016-10911
Profile Builder: Cross-site scripting
Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Aug 21, 2019 CVE-2015-9328
Profile Builder: Cross-site scripting
Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Aug 21, 2019 CVE-2014-10380
Profile Builder: Cross-site scripting
Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Oct 06, 2017 CVE-2014-8492
Profile Builder: Cross-site scripting
Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1