CVE-2026-54855
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Profile Builder plugin in versions up to 4.0.5 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The description does not specify the injection vector or vulnerable parameter.
Risk Assessment
An attacker can inject a malicious script that executes in a user's browser, potentially leading to session theft or actions performed on behalf of the victim. The risk affects sites using the vulnerable plugin.
Recommendation
Upgrade the Profile Builder plugin to a version later than 4.0.5 once a fix is available. Until then, consider disabling the plugin or applying input filtering at the WAF level.
Other vulnerabilities in Profile Builder
See all- CVE-2026-111965Medium
The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment submission paths, allowing authenticated users to bypass the anti-spam protection an administrator configured for the WordPress comment form.
- CVE-2026-96338Medium
Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.
- CVE-2026-54854Medium
The Profile Builder plugin in versions up to 4.0.5 contains a privilege escalation vulnerability allowing a Contributor-role user to elevate privileges. This may grant access to functionality reserved for higher roles.
- CVE-2026-54853Medium
Missing Authorization vulnerability in Cozmoslabs Profile Builder (profile-builder) allows exploitation of incorrectly configured access control security levels. This issue affects Profile Builder from n/a through 4.0.5.
- CVE-2026-112242High
The Cozmoslabs Profile Builder plugin (versions through 4.0.4) contains an incorrect privilege assignment vulnerability that allows privilege escalation. This may let low-privileged users gain higher privileges on a WordPress site.
- CVE-2026-82607High
A vulnerability in the Profile Builder plugin up to 3.16.1 on WordPress in the wppb_ajax_simple_avatar function of /wp-admin/admin-ajax.php allows unrestricted file upload. The attack can be performed remotely, and the exploit is public.
- CVE-2026-66701Medium
An unauthenticated Broken Access Control vulnerability in the Profile Builder plugin (versions up to 3.16.5) allows an unauthenticated attacker to gain access to functions or data that should be protected.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS