Most severe vulnerabilities for vendor "user profile builder"

Where

Sort:

Software

user profile builder

user profile builder user profile builder

Cozmoslabs Profile Builder WordpressUser Profile Builder < 3.11.8 - Unauthenticated Media Upload

Risk 47

Severity

9.1

EPSS

0.05%

Malicious File Upload

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.

First published (updated )

CVE-2024-6366

User Profile Builder User Profile BuilderUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

Risk 38

Severity

6.1

XSS

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.

First published (updated )

CVE-2024-12738

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Trending