# User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

> Powerful user profile plugin to create front-end user registration forms, login & user profile forms. Includes user role editor & content restriction.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:19 UTC.

## Facts (WordPress.org)

- Slug: `profile-builder`
- Author: Cozmoslabs
- Version: 4.0.6
- Active installs: 40,000+
- Last update: 2026-10-29 (8 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 3.1, PHP 7.4
- Tags: profile, registration, user profile, User Registration, user registration form
- Page: https://wordpress.org/plugins/profile-builder/

## Checks (against WordPress 7.1.4)

- OK: Updated 8 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Clashes ↔ Plays well, Slows pages ↔ Speeds up, Breaking ↔ Smooth, Inaccessible ↔ Accessible, Cluttered ↔ Clean.

## Known vulnerabilities

- 2026-10-24 HIGH: Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute (up to 4.0.3). CVE-2026-115807, https://www.wordfence.com/threat-intel/vulnerabilities/id/21931b7b-3c3d-4297-878e-bc0f187557a0?source=api-prod
- 2026-10-23 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (before 4.0.5). CVE-2026-111966, https://www.wordfence.com/threat-intel/vulnerabilities/id/a11db06c-32dc-456a-a5ea-5eded1f42a56?source=api-prod
- 2026-10-23 LOW: Missing Authorization (before 4.0.5). CVE-2026-111982, https://www.wordfence.com/threat-intel/vulnerabilities/id/c017b6c0-f078-4fc3-919a-8bf61dd8b4de?source=api-prod
- 2026-10-23 MEDIUM: Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass (4.0.0 to 4.0.4). CVE-2026-111965, https://www.wordfence.com/threat-intel/vulnerabilities/id/893f7ee5-e15a-4505-a6f9-29c8d346b772?source=api-prod
- 2026-10-22 MEDIUM: Authenticated (Author+) Privilege Escalation (up to 4.0.4). CVE-2026-112242, https://www.wordfence.com/threat-intel/vulnerabilities/id/667cb690-4b75-4844-a44e-34553d1481c7?source=api-prod
- 2026-10-21 MEDIUM: Reflected Cross-Site Scripting (up to 4.0.0). CVE-2026-111948, https://www.wordfence.com/threat-intel/vulnerabilities/id/e748f351-9278-4043-a15e-4a3e85f445c5?source=api-prod
- 2026-10-16 HIGH: Unauthenticated Stored Cross-Site Scripting via First Name Field (up to 4.0.3). CVE-2026-100186, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3f2ecdb-bbd0-4834-b731-88724ca0dfd7?source=api-prod
- 2026-10-16 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter (up to 4.0.3). CVE-2026-107748, https://www.wordfence.com/threat-intel/vulnerabilities/id/2f466add-992b-46c7-a1cc-5c05d59f4bdf?source=api-prod
- 2026-10-16 HIGH: Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register] (up to 4.0.3). CVE-2026-109447, https://www.wordfence.com/threat-intel/vulnerabilities/id/88bfd754-e2ee-47c7-9af5-f31cbe993102?source=api-prod
- 2026-09-30 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 4.0.2). CVE-2026-96338, https://www.wordfence.com/threat-intel/vulnerabilities/id/d2d6245c-74b9-4850-9741-d23bc4e30de3?source=api-prod
- 2026-09-25 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field (up to 4.0.2). CVE-2026-93656, https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4991ff-903a-410a-b472-1a5f76a32940?source=api-prod
- 2026-09-25 HIGH: Unauthenticated Stored Cross-Site Scripting via Avatar Field (up to 4.0.2). CVE-2026-95866, https://www.wordfence.com/threat-intel/vulnerabilities/id/68cef86f-3a6a-47c4-a092-de3bb40ac157?source=api-prod
- 2026-09-07 HIGH: Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field (up to 3.15.7). CVE-2026-6431, https://www.wordfence.com/threat-intel/vulnerabilities/id/99e6cc7b-7e65-4b8d-a927-1329ed6c1954?source=api-prod
- 2026-09-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute (up to 4.0.0). CVE-2026-75965, https://www.wordfence.com/threat-intel/vulnerabilities/id/37ac92b5-a080-4e0a-823e-6b9039c99d61?source=api-prod
- 2026-09-01 MEDIUM: Unauthenticated Stored Cross-Site Scripting via 'email' Parameter (up to 4.0.0). CVE-2026-75964, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0bd0377-8242-426d-a115-53157a8c57a1?source=api-prod
- 2026-08-30 MEDIUM: Unauthenticated Limited File Upload (up to 3.16.1). CVE-2026-82607, https://www.wordfence.com/threat-intel/vulnerabilities/id/87287221-ee9b-4ca2-bb35-f8945cd58ce7?source=api-prod
- 2026-08-29 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (before 4.0.1). CVE-2026-76546, https://www.wordfence.com/threat-intel/vulnerabilities/id/6e746509-4932-4f58-9d56-3a6596418d20?source=api-prod
- 2026-08-29 MEDIUM: Authenticated (Administrator+) PHP Object Injection (before 4.0.1). CVE-2026-76547, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b07c449-eea5-4bf6-98a7-747358b423ee?source=api-prod
- 2026-08-29 MEDIUM: Missing Authorization (before 4.0.1). CVE-2026-76548, https://www.wordfence.com/threat-intel/vulnerabilities/id/93e4fb7c-7973-496e-891f-d3b54d786e26?source=api-prod
- 2026-08-15 CRITICAL: Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter (up to 3.16.4). CVE-2026-15826, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f606fba-f779-42ea-a160-6c3b20dc5e79?source=api-prod
- 2026-08-06 MEDIUM: Missing Authorization (up to 3.16.5). CVE-2026-66701, https://www.wordfence.com/threat-intel/vulnerabilities/id/16a4665a-df79-4def-8215-df44dffdd332?source=api-prod
- 2026-08-01 HIGH: Privilege Escalation to Unauthenticated Account Takeover (up to 3.16.3). CVE-2026-15368, https://www.wordfence.com/threat-intel/vulnerabilities/id/bb865548-4074-4d0b-a222-ab5328a1db40?source=api-prod
- 2026-03-30 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field (up to 3.15.5). CVE-2026-3139, https://www.wordfence.com/threat-intel/vulnerabilities/id/760f7736-db49-4210-a2f3-3abb506106d7?source=api-prod
- 2026-01-12 CRITICAL: Unauthenticated Privilege Escalation via Account Takeover (up to 3.15.1). CVE-2025-15030, https://www.wordfence.com/threat-intel/vulnerabilities/id/49cac6e5-c224-49f3-9f3d-07b07fc5e4cc?source=api-prod
- 2025-11-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.14.8). CVE-2025-13054, https://www.wordfence.com/threat-intel/vulnerabilities/id/3830ae19-cafc-40db-afde-2424cae23031?source=api-prod
- 2025-08-15 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 3.14.3). CVE-2025-8896, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d28e118-07d3-483e-87b8-66ccdb79e879?source=api-prod
- 2025-06-05 MEDIUM: Unauthenticated Content Spoofing (up to 3.13.8). CVE-2025-49292, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e8c8027-6340-40d7-b34a-34024d5b2d89?source=api-prod
- 2025-06-02 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes (up to 3.13.8). CVE-2025-4671, https://www.wordfence.com/threat-intel/vulnerabilities/id/346c9785-0069-40ec-a255-fe2dae30f7a0?source=api-prod
- 2025-04-15 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (up to 3.13.6). CVE-2025-2314, https://www.wordfence.com/threat-intel/vulnerabilities/id/9ccf2b56-0355-43e6-a616-d06196e90972?source=api-prod
- 2025-01-06 MEDIUM: Unauthenticated Stored Cross-Site Scripting (up to 3.12.9). CVE-2024-12738, https://www.wordfence.com/threat-intel/vulnerabilities/id/51b626e1-89c0-49b9-bfeb-32005e8e78d6?source=api-prod
- 2024-08-13 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 3.12.1). CVE-2024-6708, https://www.wordfence.com/threat-intel/vulnerabilities/id/5cfede31-66c3-4d2c-a79d-0e0ea54da50c?source=api-prod
- 2024-07-10 CRITICAL: Authentication Bypass (up to 3.11.8). CVE-2024-6695, https://www.wordfence.com/threat-intel/vulnerabilities/id/2c9fa6f9-a549-4629-862f-f9a47b13aa59?source=api-prod
- 2024-07-08 MEDIUM: Missing Authorization to Unauthenticated Media Upload (up to 3.11.7). CVE-2024-6366, https://www.wordfence.com/threat-intel/vulnerabilities/id/ea1dc52d-fcd6-4b35-899a-3aff814073e0?source=api-prod
- 2024-04-05 MEDIUM: Restricted Email Bypass (up to 3.11.2). CVE-2024-31341, https://www.wordfence.com/threat-intel/vulnerabilities/id/21618fba-3f57-43b2-b9ea-13484301755d?source=api-prod
- 2024-01-16 HIGH: Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update (up to 3.10.8). CVE-2024-0324, https://www.wordfence.com/threat-intel/vulnerabilities/id/23caef95-36b6-40aa-8dd7-51a376790a40?source=api-prod
- 2024-01-05 MEDIUM: Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode (up to 3.10.6). CVE-2023-6504, https://www.wordfence.com/threat-intel/vulnerabilities/id/f515ccf8-7231-4728-b155-c47049087d42?source=api-prod
- 2023-11-07 HIGH: Cross-Site Request Forgery via pms-cross-promotion.php (up to 3.10.3). CVE-2023-47669, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b2bdb3-713c-47c6-8907-ac0f86038dc2?source=api-prod
- 2023-08-08 MEDIUM: Missing Authorization to Initial Page Creation (before 3.9.8). CVE-2023-4059, https://www.wordfence.com/threat-intel/vulnerabilities/id/7d25cca1-eb57-4ba2-8923-a3c56f41ce22?source=api-prod
- 2023-02-13 MEDIUM: Sensitive Information Disclosure via Shortcode (up to 3.9.0). CVE-2023-0814, https://www.wordfence.com/threat-intel/vulnerabilities/id/bbedad66-a5a6-4fb5-b03e-0ecf9fbef19a?source=api-prod
- 2023-02-13 CRITICAL: Insecure Password Reset Mechanism (up to 3.9.0). CVE-2023-2297, https://www.wordfence.com/threat-intel/vulnerabilities/id/e731292a-4f95-46eb-889e-b00d58f3444e?source=api-prod
- 2022-09-29 HIGH: Cross-Site Request Forgery (up to 3.6.4). CVE-2021-36915, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b44130c-b526-4670-bde2-e47fe823ac62?source=api-prod
- 2022-03-09 MEDIUM: Admin+ Stored Cross-Site Scripting (before 3.6.8). CVE-2022-0884, https://www.wordfence.com/threat-intel/vulnerabilities/id/15b9d69c-012d-4a28-b8b1-15e6dd22979e?source=api-prod
- 2022-02-17 MEDIUM: User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter (up to 3.6.1). CVE-2022-0653, https://www.wordfence.com/threat-intel/vulnerabilities/id/c8661bd7-65b7-4277-81a0-fd410ae0ee1b?source=api-prod
- 2021-07-19 CRITICAL: Admin Access via Password Reset (before 3.4.9). CVE-2021-24527, https://www.wordfence.com/threat-intel/vulnerabilities/id/63c74d96-84da-408f-ba2c-cde0ff108bf1?source=api-prod
- 2021-06-30 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 3.4.7). CVE-2021-24448, https://www.wordfence.com/threat-intel/vulnerabilities/id/35697cf5-4494-40f6-8772-dfa417ae6bcb?source=api-prod
- 2020-12-04 HIGH: Authenticated Blind SQL Injection (before 3.3.3). WF-502724d9-ccc4-42db-bc1e-c521f7c80e70-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/502724d9-ccc4-42db-bc1e-c521f7c80e70?source=api-prod
- 2020-02-13 CRITICAL: Privilege Escalation (before 3.1.1). WF-8fcf7283-eb6c-4fee-b606-79026e2227fc-1, https://www.wordfence.com/threat-intel/vulnerabilities/id/8fcf7283-eb6c-4fee-b606-79026e2227fc?source=api-prod
- 2017-03-10 MEDIUM: Cross-Site Scripting (before 2.5.8). WF-4364e713-8463-4088-b198-ed8237e86d42, https://www.wordfence.com/threat-intel/vulnerabilities/id/4364e713-8463-4088-b198-ed8237e86d42?source=api-prod
- 2016-07-13 MEDIUM: Cross-Site Scripting (before 2.4.2). CVE-2016-10911, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0b71f57-a641-4320-bec1-670bbbfbc708?source=api-prod
- 2016-07-07 HIGH: Privilege Escalation (before 2.4.1). WF-2caed42f-fb5b-488a-af15-f5ad3d82a68c, https://www.wordfence.com/threat-intel/vulnerabilities/id/2caed42f-fb5b-488a-af15-f5ad3d82a68c?source=api-prod
- 2015-11-11 MEDIUM: Reflected Cross-Site Scripting (before 2.2.5). CVE-2015-9328, https://www.wordfence.com/threat-intel/vulnerabilities/id/a2e35679-278e-4e7d-b366-fe7d8cba7930?source=api-prod
- 2015-04-15 HIGH: Missing Access Controls (up to 2.1.3). CVE-2015-9337, https://www.wordfence.com/threat-intel/vulnerabilities/id/1bd80ab9-260a-46c5-949e-c1d5dcb32523?source=api-prod
- 2014-10-30 MEDIUM: Reflected Cross-Site Scripting (up to 2.0.2). CVE-2014-8492, https://www.wordfence.com/threat-intel/vulnerabilities/id/cc358df9-7930-44da-8b33-d39db8a87b20?source=api-prod
- 2014-07-16 MEDIUM: Cross-Site Scripting (before 1.1.66). CVE-2014-10380, https://www.wordfence.com/threat-intel/vulnerabilities/id/5ab513d4-4cb9-4761-92af-a2224cb6a306?source=api-prod
- 2014-05-06 CRITICAL: Authentication Bypass (before 1.1.60). WF-c62d8146-e4b1-4c86-9d8a-c3a9bbfb0763, https://www.wordfence.com/threat-intel/vulnerabilities/id/c62d8146-e4b1-4c86-9d8a-c3a9bbfb0763?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=profile-builder · HTML: https://todaywp.com/plugins/profile-builder