Profile Builder

Profile Builder through 3.15.7 does not adequately sanitize and escape the Biographical Info meta field. An unauthenticated submitter can store script content in that field, which executes when a user visits a page that renders the injected value.

Profile Builder through 4.0.0 permits an unauthenticated attacker to submit a malicious email value that is later rendered as a javascript: row-action link in Users > Unconfirmed Email Addresses. The value reaches row_actions() without adequate sanitization or escaping and executes when an administrator with manage_options interacts with the poisoned link.

Profile Builder through 4.0.0 insufficiently sanitizes and escapes the date shortcode attribute. When an administrator has enabled wppb_toolbox_shortcodes_settings[format-date], a Contributor or higher can store script that executes when another user views the affected page.

Profile Builder 3.16.0 and 3.16.1 exposes the wppb_ajax_simple_avatar function through /wp-admin/admin-ajax.php without requiring authentication. A remote attacker can manipulate the Avatar Simple Upload AJAX handler to upload an unrestricted file to the site. The CNA reports that a public exploit is available.

Profile Builder through 3.16.4 calls absint() on wp_insert_user() before checking is_wp_error(). A registration using a 61-to-70-character username makes WordPress return WP_Error, which absint() coerces to integer 1; the plugin then issues a transient-backed autologin nonce for user ID 1. An unauthenticated visitor can use that nonce to log in as the first account, normally the site administrator. The public.

An unauthenticated visitor can reach a Profile Builder operation that lacks the required authorization check in version 3.16.5 and earlier.

Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Profile Builder is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

User Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

User Profile Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor is affected by sensitive information exposure. Exploitation requires an authenticated contributor account. Successful exploitation can disclose data that should not be available to the caller.

Profile Builder is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Profile Builder is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Profile Builder – User Profile & User Registration Forms is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

Profile Builder – User Profile & User Registration Forms is affected by sensitive information exposure. Exploitation requires an authenticated subscriber account. Successful exploitation can disclose data that should not be available to the caller.

Profile Builder is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Profile Builder – User Profile & User Registration Forms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

User Registration & User Profile – Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

User Registration & User Profile – Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Profile Builder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Profile Builder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.