CVE-2026-112242High· 8.8▾ TwilightIncorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
profile-builder <= 4.0.4Update the WordPress Profile Builder plugin to the latest available version (at least 4.0.5).
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96338Medium· 6.5Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
CVE-2026-107768High· 7.2TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
CVE-2026-107748Medium· 6.4User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
CVE-2026-109447High· 8.1User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
CVE-2026-100186High· 7.2User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
CVE-2026-105317High· 8.5Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.