Filtered by vendor Cozmoslabs Subscriptions
Filtered by product Profile Builder Subscriptions
Total 27 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-0884 1 Cozmoslabs 1 Profile Builder 2024-11-21 4.8 Medium
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2021-24527 1 Cozmoslabs 1 Profile Builder 2024-11-21 9.8 Critical
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
CVE-2021-24448 1 Cozmoslabs 1 Profile Builder 2024-11-21 4.8 Medium
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.8 does not sanitise or escape its 'Modify default Redirect Delay timer' setting, allowing high privilege users to use JavaScript code in it, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
CVE-2016-10911 1 Cozmoslabs 1 Profile Builder 2024-11-21 N/A
The profile-builder plugin before 2.4.2 for WordPress has multiple XSS issues.
CVE-2015-9337 1 Cozmoslabs 1 Profile Builder 2024-11-21 N/A
The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
CVE-2015-9328 1 Cozmoslabs 1 Profile Builder 2024-11-21 N/A
The profile-builder plugin before 2.2.5 for WordPress has XSS.
CVE-2014-10380 1 Cozmoslabs 1 Profile Builder 2024-11-21 N/A
The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.