| 2026-10-21 |
WPSEC-2026-1356 |
User Profile Builder <= 4.0.4 - Authenticated (Administrator+) Privilege Escalation via Front-End Edit Profile Form on Multisite |
High 8.0 |
4.0.5 |
| 2026-10-21 |
WPSEC-2026-1355 |
User Profile Builder <= 4.0.4 - Authenticated (Editor+) Privilege Escalation via Registration Form 'role' Attribute |
Medium 5.9 |
4.0.5 |
| 2026-10-21 |
WPSEC-2026-1354 |
User Profile Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute |
Medium 5.4 |
4.0.5 |
| 2026-10-21 |
WPSEC-2026-1353 |
User Profile Builder <= 4.0.4 - Authenticated (Subscriber+) CAPTCHA Bypass via REST API and XML-RPC Comments |
Medium 4.3 |
4.0.5 |
| 2026-10-14 |
WPSEC-2026-0892 |
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via Signup Details on Unconfirmed Emails List |
Medium 4.7 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0891 |
User Profile Builder <= 4.0.3 - Authenticated (Author+) Privilege Escalation via Register Block and Elementor Widget |
High 8.8 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0890 |
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via 'role' Custom Field on Registration with Email Confirmation |
High 8.1 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0889 |
User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Avatar Image |
Medium 6.4 |
4.0.4 |
| 2026-10-14 |
WPSEC-2026-0888 |
User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation via Select (User Role) Field |
High 8.1 |
4.0.4 |
