Plugin security history

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 33 vulnerability records associated with User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

33Total records

6Critical

6High

21Medium

0Low

0Informational

33Patched records

0Currently marked unpatched

2014-05-06First disclosure

2026-03-30Latest disclosure

28 of 33CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	3	3 records
2015	2	2 records
2016	2	2 records
2017	1	1 records
2020	2	2 records
2021	2	2 records
2022	3	3 records
2023	4	4 records
2024	6	6 records
2025	6	6 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	6	18.2%
High	6	18.2%
Medium	21	63.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

14 records42.4%

First: 2014. Latest: 2025.

Missing Authorization

7 records21.2%

First: 2016. Latest: 2026.

Privilege Escalation

4 records12.1%

First: 2015. Latest: 2026.

Authentication Bypass

3 records9.1%

First: 2014. Latest: 2024.

Other

2 records6.1%

First: 2023. Latest: 2025.

SQL Injection

1 record3%

First: 2020. Latest: 2020.

Information Disclosure

1 record3%

First: 2023. Latest: 2023.

CSRF

1 record3%

First: 2023. Latest: 2023.

Patch Status

Patched: 33
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.15.6
3.15.2
3.14.9
3.14.4
3.13.9
3.13.7
3.13.0
3.12.2
3.11.9
3.11.8
3.11.3
3.10.9
3.10.8
3.10.4
3.9.8
3.9.1
3.6.5
3.6.8
3.6.2
3.4.9
3.4.8
3.3.3
3.1.1
2.5.8
2.4.2
2.4.1
2.2.5
2.1.4
2.0.3
1.1.66
1.1.60

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.15.5`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field	March 30, 2026	3.15.6	Medium
`*-3.15.1`	User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover	January 12, 2026	3.15.2	Critical
`*-3.14.8`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	November 18, 2025	3.14.9	Medium
`*-3.14.3`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting	August 15, 2025	3.14.4	Medium
`*-3.13.8`	Profile Builder <= 3.13.8 - Unauthenticated Content Spoofing	June 5, 2025	3.13.9	Medium
`*-3.13.8`	Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes	June 2, 2025	3.13.9	Medium
`*-3.13.6`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	April 15, 2025	3.13.7	Medium
`*-3.12.9`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting	January 6, 2025	3.13.0	Medium
`*-3.12.1`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.1 - Authenticated (Admin+) Stored Cross-Site Scripting	August 13, 2024	3.12.2	Medium
`*-3.11.8`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 - Authentication Bypass	July 10, 2024	3.11.9	Critical
`*-3.11.7`	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.7 - Missing Authorization to Unauthenticated Media Upload	July 8, 2024	3.11.8	Medium
`*-3.11.2`	Profile Builder <= 3.11.2 - Restricted Email Bypass	April 5, 2024	3.11.3	Medium
`*-3.10.8`	User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update	January 16, 2024	3.10.9	High
`*-3.10.6`	Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode	January 5, 2024	3.10.8	Medium
`*-3.10.3`	Profile Builder <= 3.10.3 - Cross-Site Request Forgery via pms-cross-promotion.php	November 7, 2023	3.10.4	High
`[*, 3.9.8)`	Profile Builder <= 3.9.7 - Missing Authorization to Initial Page Creation	August 8, 2023	3.9.8	Medium
`*-3.9.0`	Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism	February 13, 2023	3.9.1	Critical
`*-3.9.0`	Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Sensitive Information Disclosure via Shortcode	February 13, 2023	3.9.1	Medium
`*-3.6.4`	Profile Builder – User Profile & User Registration Forms <= 3.6.4 - Cross-Site Request Forgery	September 29, 2022	3.6.5	High
`[*, 3.6.8)`	Profile Builder <= 3.6.7 - Admin+ Stored Cross-Site Scripting	March 9, 2022	3.6.8	Medium
`*-3.6.1`	Profile Builder - User Profile & User Registration Forms <= 3.6.1 - Cross-Site Scripting via site_url Parameter	February 17, 2022	3.6.2	Medium
`[*, 3.4.9)`	Profile Builder <= 3.4.8 - Admin Access via Password Reset	July 19, 2021	3.4.9	Critical
`*-3.4.7`	Profile Builder <= 3.4.7 - Authenticated (Administrator+) Stored Cross-Site Scripting	June 30, 2021	3.4.8	Medium
`[*, 3.3.3)`	Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection	December 4, 2020	3.3.3	High
`[*, 3.1.1)`	Profile Builder <= 3.1.0 - Privilege Escalation	February 13, 2020	3.1.1	Critical

Selected source records

Latest Records

MediumCVE-2026-3139

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field

Published: March 30, 2026

Affected versions: *-3.15.5
Patched versions: 3.15.6

Original Wordfence record

CriticalCVE-2025-15030

User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover

Published: January 12, 2026

Affected versions: *-3.15.1
Patched versions: 3.15.2

Original Wordfence record

MediumCVE-2025-13054

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: November 18, 2025

Affected versions: *-3.14.8
Patched versions: 3.14.9

Original Wordfence record

MediumCVE-2025-8896

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: August 15, 2025

Affected versions: *-3.14.3
Patched versions: 3.14.4

Original Wordfence record

MediumCVE-2025-49292

Profile Builder <= 3.13.8 - Unauthenticated Content Spoofing

Published: June 5, 2025

Affected versions: *-3.13.8
Patched versions: 3.13.9

Original Wordfence record

MediumCVE-2025-4671

Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes

Published: June 2, 2025

Affected versions: *-3.13.8
Patched versions: 3.13.9

Original Wordfence record

MediumCVE-2025-2314

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: April 15, 2025

Affected versions: *-3.13.6
Patched versions: 3.13.7

Original Wordfence record

MediumCVE-2024-12738

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

Published: January 6, 2025

Affected versions: *-3.12.9
Patched versions: 3.13.0

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-6695

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.11.8 - Authentication Bypass

Published: July 10, 2024

Affected versions: *-3.11.8
Patched versions: 3.11.9

Original Wordfence record

CriticalCVE-2025-15030

User Profile Builder <= 3.15.1 - Unauthenticated Privilege Escalation via Account Takeover

Published: January 12, 2026

Affected versions: *-3.15.1
Patched versions: 3.15.2

Original Wordfence record

CriticalCVE-2021-24527

Profile Builder <= 3.4.8 - Admin Access via Password Reset

Published: July 19, 2021

Affected versions: [*, 3.4.9)
Patched versions: 3.4.9

Original Wordfence record

Critical

Profile Builder <= 3.1.0 - Privilege Escalation

Published: February 13, 2020

Affected versions: [*, 3.1.1)
Patched versions: 3.1.1

Affected versions: [*, 3.1.1)
Patched versions: 3.1.1

Original Wordfence record

Critical

Profile Builder – User Profile & User Registration Forms Plugin < 1.1.60 - Authentication Bypass

Published: May 6, 2014

Affected versions: [*, 1.1.60)
Patched versions: 1.1.60

Original Wordfence record

CriticalCVE-2023-2297

Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism

Published: February 13, 2023

Affected versions: *-3.9.0
Patched versions: 3.9.1

Original Wordfence record

High

Profile Builder <= 2.4.0 - Privilege Escalation

Published: July 7, 2016

Affected versions: [*, 2.4.1)
Patched versions: 2.4.1

Original Wordfence record

High

Profile Builder/Profile Builder Pro <= 3.3.2 - Authenticated Blind SQL Injection

Published: December 4, 2020

Affected versions: [*, 3.3.3)
Patched versions: 3.3.3

Affected versions: [*, 3.3.3)
Patched versions: 3.3.3

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory