Cozmoslabs
Vulnerability activity for Cozmoslabs: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 11
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 17
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 17
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.5MediumNov 3, 2026Cozmoslabs Paid Member Subscriptions XSSCVE-2026-119521Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.
- 7.1HighOct 30, 2026Cozmoslabs Profile Builder XSSCVE-2026-54855Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
- 6.3MediumOct 30, 2026Cozmoslabs Profile Builder Privilege escalationCVE-2026-54854Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.
- 5.3MediumOct 29, 2026Cozmoslabs Profile Builder Auth bypass / access controlCVE-2026-54853Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.
- 7.1HighOct 24, 2026Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Privilege escalationCVE-2026-115807The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the `[wppb-register]` shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capabilit
- 6.5MediumOct 22, 2026Cozmoslabs Paid Member Subscriptions Auth bypass / access controlCVE-2026-112842Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2.
- 8.8HighOct 22, 2026Cozmoslabs Profile Builder Privilege escalationCVE-2026-112242Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege Escalation.This issue affects Profile Builder: from n/a through 4.0.4.
- 7.2HighOct 16, 2026Cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation XSSCVE-2026-107768The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission
- 8.1HighOct 16, 2026Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Privilege escalationCVE-2026-109447The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.0.3 via the `role` parameter handled by the `wppb_add_meta_to_user_on_activation()` function. The vulnerability exists because the activation handler passes the attacker-supplied role value directly to `WP_User::set_role()` with no allow-list validation, and the 4.0.3 reserved-name check exempts pre-exist
- 6.4MediumOct 16, 2026Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor XSSCVE-2026-107748The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payl
- 7.2HighOct 16, 2026Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor XSSCVE-2026-100186The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confi
- 8.5HighOct 6, 2026Cozmoslabs Paid Member Subscriptions SQL injectionCVE-2026-105317Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.
- 7.1HighOct 4, 2026Cozmoslabs TranslatePress XSSCVE-2026-103062Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Stored XSS.This issue affects TranslatePress: from n/a through 3.3.6.
- 5.3MediumSep 30, 2026Cozmoslabs Paid Member Subscriptions Auth bypass / access controlCVE-2026-97249Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
- 6.5MediumSep 30, 2026Cozmoslabs Profile Builder XSSCVE-2026-96338Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
- 7.2HighSep 22, 2026Cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation XSSCVE-2026-89412The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can see
- 7.2HighSep 7, 2026Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor XSSCVE-2026-6431The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Top products
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor5 CVEs in the last year
- Profile Builder5 CVEs in the last year
- Paid Member Subscriptions4 CVEs in the last year
- TranslatePress – Translate Multilingual sites with AI Translation2 CVEs in the last year
- TranslatePress1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.