¿Es seguro Profile Builder?

Qué hace este plugin

• Slug: profile-builder
• 50000+ instalaciones activas

profileregistrationuser profileUser Registrationuser registration form

Estado de mantenimiento

• Última versión conocida: 3.16.5
• Requiere PHP: 7.4+

Vulnerabilidades conocidas

27 CVEs conocidos registrados para Profile Builder.

CVE-2025-15030

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.15.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-13054

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-49292

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Content Spoofing in all versions up to, and including, 3.13.8. This makes it possible for unauthenticated attackers to spoof content.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-12738

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-6695

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to authenticated bypass in all versions up to, and including, 3.11.8. This is due to the plugin not properly handling the user registration flow and utilizing different functionality at different stages of the process. This makes it possible for unauthenticated attackers to login as other users granted they know the user's email address.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-6366

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized file uplloads due to a missing capability check on the wppb_upload_file_type() function in all versions up to, and including, 3.11.7. This makes it possible for unauthenticated attackers to upload arbitrary media files via the async upload functionality.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-31341

Update the WordPress Profile Builder plugin to the latest available version (at least 3.11.3). Ananda Dhakal (Patchstack) discovered and reported this Bypass Vulnerability vulnerability in WordPress Profile Builder Plugin. A bypass vulnerability could allow a malicious actor to bypass certain restrictions in the code. This vulnerability has been fixed in version 3.11.3. This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-0324

Update the WordPress Profile Builder plugin to the latest available version (at least 3.10.9). kodaichodai discovered and reported this Broken Access Control vulnerability in WordPress Profile Builder Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.10.9. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 39 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2023-6504	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.10.8	Elusión de autorización mediante una clave controlada por el usuario	Media 4,3	< 3.10.8	3.10.8	2024-01-05	✓ corregido en la última versión
CVE-2023-47669	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.10.4	Falsificación de petición en sitios cruzados (CSRF)	Media 5,4	< 3.10.4	3.10.4	2023-11-08	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.10.4	—	Desconocido	< 3.10.4	3.10.4	2023-11-07	✓ corregido en la última versión
CVE-2023-4059	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.9.8	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 3.9.8	3.9.8	2023-09-04	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.9.8	—	Desconocido	< 3.9.8	3.9.8	2023-08-09	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.9.8	—	Desconocido	< 3.9.8	3.9.8	2023-08-08	✓ corregido en la última versión
CVE-2023-0814	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.9.1	Exposición de información sensible a un actor no autorizado	Media 6,5	< 3.9.1	3.9.1	2023-02-13	✓ corregido en la última versión
CVE-2023-2297	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.9.1	Autenticación indebida	Alta 8,1	< 3.9.1	3.9.1	2023-02-13	✓ corregido en la última versión
CVE-2021-36915	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.6.5	Falsificación de petición en sitios cruzados (CSRF)	Media 4,2	< 3.6.5	3.6.5	2022-09-29	✓ corregido en la última versión
CVE-2022-0884	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.6.8	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.6.8	3.6.8	2022-03-09	✓ corregido en la última versión
CVE-2022-0653	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.6.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 3.6.2	3.6.2	2022-02-17	✓ corregido en la última versión
CVE-2021-24527	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.4.9	Autenticación indebida	Crítica 9,8	< 3.4.9	3.4.9	2021-07-19	✓ corregido en la última versión
CVE-2021-24448	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.4.8	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.4.8	3.4.8	2021-06-30	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3	—	Desconocido	< 3.3.3	3.3.3	2020-12-04	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3	—	Desconocido	< 3.3.3	3.3.3	2020-12-02	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.1.1	—	Desconocido	< 3.1.1	3.1.1	2020-02-13	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.1.1	—	Desconocido	< 3.1.1	3.1.1	2020-02-10	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.5.8	—	Desconocido	< 2.5.8	2.5.8	2017-03-10	✓ corregido en la última versión
CVE-2016-10911	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.4.2	2.4.2	2016-07-13	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.2	—	Desconocido	< 2.4.2	2.4.2	2016-07-13	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.1	—	Desconocido	< 2.4.1	2.4.1	2016-07-08	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.1	—	Desconocido	< 2.4.1	2.4.1	2016-07-07	✓ corregido en la última versión
CVE-2015-9328	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.2.5	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.2.5	2.2.5	2015-11-11	✓ corregido en la última versión
CVE-2015-9337	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.1.4	Control de acceso incorrecto	Alta 7,5	< 2.1.4	2.1.4	2015-04-15	✓ corregido en la última versión
CVE-2014-8492	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.0.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 2.0.3	2.0.3	2014-10-30	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 1.1.60	—	Desconocido	< 1.1.60	1.1.60	2014-08-01	✓ corregido en la última versión
CVE-2014-10380	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 1.1.66	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,1	< 1.1.66	1.1.66	2014-07-16	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 1.1.60	—	Desconocido	< 1.1.60	1.1.60	2014-05-06	✓ corregido en la última versión
CVE-2025-2314	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.13.7	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 3.13.7	3.13.7	0000-00-00	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.12.2	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 3.12.2	3.12.2	0000-00-00	✓ corregido en la última versión
CVE-2025-4671	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.13.9	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 3.13.9	3.13.9	0000-00-00	✓ corregido en la última versión
CVE-2025-8896	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.14.4	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,4	< 3.14.4	3.14.4	0000-00-00	✓ corregido en la última versión
CVE-2026-3139	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.15.6	—	Desconocido	< 3.15.6	3.15.6	0000-00-00	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.5.1	—	Desconocido	< 3.5.1	3.5.1	—	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3	—	Desconocido	< 3.3.3	3.3.3	—	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.1.1	—	Desconocido	< 3.1.1	3.1.1	—	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.5.8	—	Desconocido	< 2.5.8	2.5.8	—	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.1	—	Desconocido	< 2.4.1	2.4.1	—	✓ corregido en la última versión
—	User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 1.1.60	—	Desconocido	< 1.1.60	1.1.60	—	✓ corregido en la última versión

CVE-2023-6504

Update the WordPress Profile Builder plugin to the latest available version (at least 3.10.8). Francesco Carlucci discovered and reported this Insecure Direct Object References (IDOR) vulnerability in WordPress Profile Builder Plugin. An insecure direct object reference vulnerability could allow a malicious actor to bypass authorization, authentication, access sensitive files/folders or interact with the database. This vulnerability has been fixed in version 3.10.8. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-47669

Update the WordPress Profile Builder plugin to the latest available version (at least 3.10.4). Brandon Roldan discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Profile Builder Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 3.10.4.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.10.4

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.10.3. This is due to missing or incorrect nonce validation on the wppb_activate_pms_plugin and wppb_deactivate_pms_plugin functions. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-4059

The Profile Builder WordPress plugin before 3.9.8 lacks authorisation and CSRF in its page creation function which allows unauthenticated users to create the register, log-in and edit-profile pages from the plugin on the blog

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.9.8

Update the WordPress Profile Builder plugin to the latest available version (at least 3.9.8). WordFence discovered and reported this Broken Access Control vulnerability in WordPress Profile Builder Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 3.9.8.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.9.8

The Profile Builder plugin for WordPress is vulnerable to unauthorized page creation due to a missing capability check on the wppb_create_form_pages() function called via an admin_init action in versions up to, and including, 3.9.7. This makes it possible for unauthenticated attackers to trigger the initial page creation to support the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-0814

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to sensitive information disclosure via the [user_meta] shortcode in versions up to, and including 3.9.0. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to retrieve sensitive user meta that can be used to gain access to a high privileged user account. This does require the Usermeta shortcode be enabled to be exploited.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-2297

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 3.9.0. This is due to the plugin using native password reset functionality, with insufficient validation on the password reset function (wppb_front_end_password_recovery). The function uses the plaintext value of a password reset key instead of a hashed value which means it can easily be retrieved and subsequently used. An attacker can leverage CVE-2023-0814, or another vulnerability like SQL Injection in another plugin or theme installed on the site to successfully exploit this vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-36915

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.4. This is due to missing nonce validation on the wppb_pbie_import() & wppb_pbie_export_our_json() functions. This makes it possible for unauthenticated attackers to import and export plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-0884

The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-0653

The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-24527

The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2021-24448

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.4.7 due to insufficient input sanitization and output escaping on the 'Modify default Redirect Delay timer' setting. This makes it possible for authenticated attackers. with administrator-level privileges or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3

The Profile Builder/Profile Builder Pro plugins for WordPress is vulnerable to blind SQL Injection via multiple parameters in versions up to, and including, 3.3.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3

Authenticated Blind SQL Injection (SQLi) vulnerability found by Lenon Leite in WordPress Profile Builder plugin (versions <= 3.3.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.1.1

The Profile Builder and Profile Builder Pro plugin versions up to and including 3.1.0 allows unauthenticated attackers to gain administrator-level permissions by registering users on a vulnerable site and assigning their own role.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.1.1

User Registration With Administrator Role vulnerability found by Noman Riffat in WordPress Profile Builder plugin (versions <= 3.1.0).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.5.8

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wppb_general_settings[minimum_password_length]’ parameter in versions before 2.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with high privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2016-10911

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Reflected Cross-Site Scripting (XSS) security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.2

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.1

This plugin is prone to a privilege escalation vulnerability. Update this plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.1

The Profile Builder plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.4.0. This makes it possible for subscriber-level attackers to elevate user roles to administrative levels, giving them full control of the website. This vulnerability only impacts websites that have registration enabled, but given that the plugin functionality is directly related to registration it is likely that the majority of websites with the plugin installed are effected.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9328

The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'loginerror', 'wckerrorfields', 'wckerrormessages', and 'field_name' parameters in versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2015-9337

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Missing Access Controls security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2014-8492

Multiple cross-site scripting (XSS) vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) site_name, (2) message, or (3) site_url parameter.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 1.1.60

Because of this vulnerability, an attacker may exploit this issue to reset account passwords for arbitrary users which may aid in further attacks. Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2014-10380

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Multiple XSS security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 1.1.60

The Profile Builder – User Profile & User Registration Forms Plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.1.59. This is due to a failure to restrict access on the password reset form. This makes it possible for unauthenticated attackers to reset passwords of user accounts, including administrator accounts.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-2314

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The issue was partially patched in version 3.13.6 of the plugin, and fully patched in 3.13.7.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.12.2

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-4671

The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to, and including, 3.13.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-8896

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr_communication_preferences[]' parameter in all versions up to, and including, 3.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-3139

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.15.5 via the wppb_save_avatar_value() function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to reassign ownership of arbitrary posts and attachments by changing 'post_author'.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.5.1

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.3.3

The orderby parameter of the wp-admin/users.php?page=unconfirmed_emails&orderby=email&order=asc page, which is available when the "Email confirmation" setting of the plugin is activated (default is off), is not properly sanitised and validated before being concatenated in a SQL statement, leading to an SQL injection. The issue is exploitable by high privilege users such as administrators.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.1.1

The plugin is affected by a broken authentication vulnerability, allowing unauthenticated users to register or edit their account and gain the Administrator role using the plugin's forms. The vulnerability only exists in the Plugin's own generated Registration Form or Profile Edit Form. This means if the blog is using shortcode [wppb-register] or [wppb-edit-profile] then it is vulnerable. This is very obvious shortcode which holds the basic functionality of the plugin so admin must be using it 90% of time if installed. If blog isn't using [wppb-register] but using [wppb-edit-profile] then vulnerability is still valid if Registration is enabled. CVSS Score of the vulnerability is 9.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.5.8

Stored Cross-Site Scripting (XSS) in field minimum password length.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 2.4.1

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Privilege Escalation security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 1.1.60

The User Registration & User Profile – Profile Builder WordPress plugin was affected by a Password Recovery Bypass security vulnerability in the front-end/wppb.recover.password.php file.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Profile Builder actualizado — 3.16.5 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Simple Local Avatars — 100000+ instalaciones activas — 92/100 (89) — PHP máx. 8.4
• Gravatar Enhanced – Avatars, Profiles, and Privacy — 100000+ instalaciones activas — 100/100 (3) — PHP máx. 8.4
• One User Avatar | User Profile Picture — 100000+ instalaciones activas — 94/100 (41) — PHP máx. 8.4
• WP-Members Membership Plugin — 50000+ instalaciones activas — 92/100 (272)
• Login & Register Forms – Popup | Slider | Inline | WooCommerce — 40000+ instalaciones activas — 96/100 (254)