Now officially on WordPress.org

CVE Database / CVE-2024-12738

CVE · Medium

CVE-2024-12738 — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.13.0

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2024-12738 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor [profile-builder] < 3.13.0 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 3.13.0 3.13.0 2025-01-06 —

CVE-2024-12738

The User Profile Builder plugin for WordPress versions up to 3.12.9 contains a stored cross-site scripting vulnerability affecting multiple user meta parameters. Attackers without authentication can insert malicious scripts through insufficiently sanitized inputs, and these scripts execute when authorized users view pages displaying the affected user metadata. The flaw stems from inadequate input validation and output encoding mechanisms in the plugin's handling of user meta fields.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings