User Profile Builder vulnerability: is your WooCommerce store affected?

The security holes

Newest first. Each one is published in a public security database and fixed in the version shown.

1. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.1 (high)no login neededAffected: older than 4.0.6Fixed in 4.0.6Published 30 October 2026CVE-2026-54855

   Advisory: Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

2. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 7.1 (high)needs only a customer accountAffected: older than 4.0.4Fixed in 4.0.4Published 24 October 2026CVE-2026-115807

   Advisory: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3.

3. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.8 (high)needs only a customer accountAffected: older than 4.0.5Fixed in 4.0.5Published 22 October 2026CVE-2026-112242

   Advisory: Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.

4. Privilege escalation

   A user could give themselves more rights, up to full admin.

   Score 8.1 (high)no login neededAffected: older than 4.0.4Fixed in 4.0.4Published 15 October 2026CVE-2026-109447

   Advisory: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role`...

5. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 4.0.4Fixed in 4.0.4Published 15 October 2026CVE-2026-100186

   Advisory: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and...

6. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 4.0.3Fixed in 4.0.3Published 24 September 2026CVE-2026-95866

   Advisory: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including,...

7. Cross-site scripting

   Someone could plant a script that runs in your visitors' or your admins' browsers.

   Score 7.2 (high)no login neededAffected: older than 3.15.8Fixed in 3.15.8Published 31 August 2026CVE-2026-6431

   Advisory: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all...

8. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 9.8 (critical)no login neededAffected: older than 3.16.5Fixed in 3.16.5Published 14 August 2026CVE-2026-15826

   Advisory: The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4.

9. Account takeover

   Someone could log in as another user, an admin included, without their password.

   Score 9.8 (critical)no login neededAffected: older than 3.15.2Fixed in 3.15.2Published 12 January 2026CVE-2025-15030

   Advisory: The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as...

10. Missing permission check

    An action that should need permission could be done without it.

    Score 9.8 (critical)no login neededAffected: older than 3.11.9Fixed in 3.11.9Published 10 July 2024CVE-2024-6695

    Advisory: it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions.

11. File upload

    Someone could upload files to your server, which can include code.

    Score 9.1 (critical)no login neededAffected: older than 3.11.8Fixed in 3.11.8Published 8 July 2024CVE-2024-6366

    Advisory: The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.

12. Missing permission check

    An action that should need permission could be done without it.

    Score 7.5 (high)no login neededAffected: older than 3.10.9Fixed in 3.10.9Published 16 January 2024CVE-2024-0324

    Advisory: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

13. Account takeover

    Someone could log in as another user, an admin included, without their password.

    Score 8.1 (high)needs only a customer accountAffected: older than 3.9.1Fixed in 3.9.1Published 13 February 2023CVE-2023-2297

    Advisory: The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0.

2 older holes, published before 1 January 2023

1. Missing permission check

   An action that should need permission could be done without it.

   Score 9.8 (critical)no login neededAffected: older than 3.4.9Fixed in 3.4.9Published 19 July 2021CVE-2021-24527

   Advisory: The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the...

2. Missing permission check

   An action that should need permission could be done without it.

   Score 7.5 (high)no login neededAffected: older than 2.1.4Fixed in 2.1.4Published 15 April 2015CVE-2015-9337

   Advisory: The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

How to check your version

1. Log in to WordPress and open Plugins > Installed Plugins.
2. Find User Profile Builder. The version number is under its name. If it is lower than 4.0.6, your store is affected.
3. No login to hand? Open https://yourstore.com/wp-content/plugins/profile-builder/readme.txt in a browser, with your own address in place of yourstore.com, and read the Stable tag line. Some hosts block this file; then use step 1.

How to fix it

1. Make a backup, or better, a staging copy of the store (most hosts have a one-click staging button).
2. On the copy, update User Profile Builder to 4.0.6 or newer: Dashboard > Updates, or Update now on the Plugins page.
3. If no update shows, it may be a paid version whose licence has run out: download the new version from the seller's site and upload it.
4. Place a test order on the copy: add to cart, check out, pay with a test method. Check the pages that use User Profile Builder.
5. If everything works, make the same update on the live store and place one more test order.
6. If you no longer use User Profile Builder, delete it instead of leaving it deactivated.

Questions

Which User Profile Builder version fixes it?

Version 4.0.6 or newer fixes all 15 issues on this page.

How do I know if my store is affected?

Your store is affected if it runs User Profile Builder older than 4.0.6. In WordPress, open Plugins and read the version under User Profile Builder. Without logging in, open yourstore.com/wp-content/plugins/profile-builder/readme.txt and read the Stable tag line.

I don't use User Profile Builder any more. Is a deactivated copy safe?

Deactivating it lowers the risk but leaves the old code on your server. If you don't use it, delete it; if you do, update it.

Can someone fix it for me?

Yes. We update the store on a copy first, place a test order, and only then make the same change on the live store, for a fixed price.

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.