Cozmoslabs
81 CVEs across 19 Cozmoslabs products. Browse Cozmoslabs vulnerabilities, severities, and proof-of-concept exploits.
Cozmoslabs products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-95866 | High | 7.2 | 2026-09-25 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-93656 | Medium | 6.4 | 2026-09-25 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-89412 | High | 7.2 | 2026-09-22 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory… |
CVE-2026-6431 | High | 7.2 | 2026-09-07 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-75964 | Medium | 6.1 | 2026-09-01 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-75965 | Medium | 6.4 | 2026-09-01 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-82607 | High | 7.3 | 2026-08-31 | A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the f… |
CVE-2026-76053 | High | 7.2 | 2026-08-28 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key I… |
CVE-2026-19632 | Critical | 9.8 | 2026-08-26 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t… |
CVE-2026-18512 | Medium | 6.4 | 2026-08-25 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Bo… |
CVE-2026-78267 | Critical | 9.8 | 2026-08-24 | Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions. |
CVE-2026-66582 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions. |
CVE-2026-75981 | High | 7.2 | 2026-08-19 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in vers… |
CVE-2026-15826 | Critical | 9.8 | 2026-08-15 | The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due t… |
CVE-2026-66701 | Medium | 5.3 | 2026-08-06 | Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions. |
CVE-2026-18510 | High | 7.2 | 2026-08-06 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (UR… |
CVE-2026-17505 | Medium | 6.1 | 2026-08-05 | The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to… |
CVE-2026-59539 | High | 7.5 | 2026-07-27 | Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions. |
CVE-2026-61971 | Low | 2.7 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Config… |
CVE-2026-57348 | High | 7.2 | 2026-07-02 | Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions. |
CVE-2026-42385 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions. |
CVE-2026-39514 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions. |
CVE-2026-7647 | High | 8.1 | 2026-05-02 | The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.14.5. This is due to the use of PHP's… |
CVE-2026-3139 | Medium | 4.3 | 2026-03-31 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Ref… |
CVE-2026-27413 | Critical | 9.3 | 2026-03-19 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro allows Blind SQL Injection… |
CVE-2025-68514 | Medium | 6.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly… |
CVE-2025-66074 | Critical | 9.0 | 2025-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from… |
CVE-2025-66073 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through… |
CVE-2025-13054 | Medium | 6.4 | 2025-11-19 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-58592 | High | 8.1 | 2025-11-06 | Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePr… |
CVE-2025-11835 | Medium | 5.3 | 2025-11-05 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2025-58600 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-8895 | Critical | 9.8 | 2025-08-21 | The WP Webhooks plugin for WordPress is vulnerable to arbitrary file copy due to missing validation of user-supplied input in all versions up to, and including… |
CVE-2025-54017 | High | 7.5 | 2025-08-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions p… |
CVE-2025-8896 | Medium | 6.4 | 2025-08-16 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-49870 | High | 7.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscrip… |
CVE-2025-49292 | Medium | 4.3 | 2025-06-06 | Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Build… |
CVE-2025-4671 | Medium | 6.4 | 2025-06-03 | The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to… |
CVE-2024-6708 | Medium | 4.8 | 2025-05-15 | The User Profile Builder WordPress plugin before 3.12.2 does not sanitise and escape some parameters before outputting its content on the admin area, which al… |
CVE-2025-2314 | Medium | 6.4 | 2025-04-16 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-31088 | Medium | 6.5 | 2025-03-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscrip… |
CVE-2025-30773 | High | 7.2 | 2025-03-27 | Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePr… |
CVE-2024-12919 | Critical | 9.8 | 2025-01-14 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Authentication Bypas… |
CVE-2024-12738 | Medium | 6.1 | 2025-01-07 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2024-11291 | Medium | 5.3 | 2024-12-18 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Sensitive Informatio… |
CVE-2024-10261 | High | 7.3 | 2024-11-09 | The The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to arbitrary shortc… |
CVE-2024-9222 | Medium | 6.1 | 2024-10-02 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Reflected Cross-Site… |
CVE-2024-6695 | Critical | 9.8 | 2024-07-31 | it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is d… |
CVE-2024-6366 | Critical | 9.1 | 2024-07-29 | The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async… |
CVE-2024-5639 | Medium | 4.3 | 2024-06-21 | The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_c… |
CVE-2024-31341 | Medium | 5.3 | 2024-05-17 | Insufficient Verification of Data Authenticity vulnerability in Cozmoslabs Profile Builder allows Functionality Bypass.This issue affects Profile Builder: from… |
CVE-2024-32728 | Medium | 4.3 | 2024-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.11.0. |
CVE-2023-51522 | Medium | 4.3 | 2024-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Paid Member Subscriptions.This issue affects Paid Member Subscriptions: from n/a through 2.10.4. |
CVE-2024-1390 | Medium | 4.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-1389 | Medium | 5.3 | 2024-02-29 | The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modific… |
CVE-2024-0324 | High | 8.2 | 2024-02-05 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification… |
CVE-2024-22140 | High | 8.8 | 2024-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a through 3.10.0. |
CVE-2024-22141 | Medium | 6.5 | 2024-01-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder Pro: from n/a thr… |
CVE-2024-22142 | High | 7.1 | 2024-01-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Profile Builder Pro allows Reflected XSS.This… |
CVE-2023-6504 | Medium | 4.3 | 2024-01-11 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of dat… |
CVE-2023-47669 | Medium | 5.4 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin… |
CVE-2023-4059 | Medium | 4.3 | 2023-09-04 | The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the r… |
CVE-2023-2297 | Critical | 9.8 | 2023-04-27 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and includi… |
CVE-2023-25968 | Medium | 4.3 | 2023-03-15 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Portal – Private user pages and login plugin <= 1.1.8… |
CVE-2023-0814 | Medium | 6.5 | 2023-02-14 | The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortco… |
CVE-2022-4442 | Medium | 4.8 | 2023-01-16 | The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privile… |
CVE-2021-36915 | Medium | 4.2 | 2022-10-11 | Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder plugin <= 3.6.0 at WordPress allows uploading the JSON file and updating the opti… |
CVE-2022-3141 | High | 8.8 | 2022-09-19 | The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page… |
CVE-2022-0884 | Medium | 4.8 | 2022-04-04 | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such a… |
CVE-2022-0653 | Medium | 6.1 | 2022-02-24 | The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitizati… |
CVE-2021-24610 | Medium | 4.8 | 2021-09-27 | The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only re… |
CVE-2021-24728 | High | 8.8 | 2021-09-13 | The Membership & Content Restriction – Paid Member Subscriptions WordPress plugin before 2.4.2 did not sanitise, validate or escape its order and orderby param… |
CVE-2021-24527 | Critical | 9.8 | 2021-08-16 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog… |
CVE-2021-24473 | Medium | 5.4 | 2021-08-02 | The User Profile Picture WordPress plugin before 2.6.0 was affected by an IDOR issue, allowing users with the upload_image capability (by default author and ab… |
CVE-2021-24448 | Medium | 4.8 | 2021-08-02 | The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' sett… |
CVE-2021-24170 | High | 7.5 | 2021-04-05 | The REST API endpoint get_users in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to… |
CVE-2015-9337 | High | 7.5 | 2019-08-22 | The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX. |
CVE-2016-10911 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues. |
CVE-2015-9328 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 2.2.5 for WordPress has XSS. |
CVE-2014-10380 | Medium | 6.1 | 2019-08-21 | The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms. |
CVE-2014-8492 | Medium | 6.1 | 2017-10-06 | Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote atta… |