user_profile_builder vulnerabilities

CVEs whose affected-version data names the user_profile_builder package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-111948None

today

Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.

▾ Sunlitvia CVEORG