Is CVE-2026-75965 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75965 being exploited in the wild.

How severe is CVE-2026-75965?

Medium severity, with a CVSS score of 6.4, published 1 September 2026.

Which products and versions are affected?

Cozmoslabs Profile Builder up to 4.0.0.

Is there a fix for CVE-2026-75965?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75965 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-75965?

Check whether you run Cozmoslabs Profile Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75965: Profile Builder stored XSS via date shortcode attribute

CVE-2026-75965 · Severity: medium · CVSS 6.4 · Published 2026-09-01

Profile Builder is a popular WordPress plugin for creating user registration forms and managing user profiles. The plugin is vulnerable to stored cross-site scripting (XSS) attacks through the date shortcode feature, allowing authenticated contributors to inject malicious scripts that execute when other users view affected pages. This can lead to account compromise, credential theft, or malware distribution to site visitors.

Technologies: Cozmoslabs Profile Builder. Vendors: Cozmoslabs.

Quick answers

Is CVE-2026-75965 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75965 being exploited in the wild.
How severe is CVE-2026-75965?: Medium severity, with a CVSS score of 6.4, published 1 September 2026.
Which products and versions are affected?: Cozmoslabs Profile Builder up to 4.0.0.
Is there a fix for CVE-2026-75965?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75965 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-75965?: Check whether you run Cozmoslabs Profile Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS flaw in the 'date' shortcode attribute handler due to insufficient input sanitization and output escaping. The vulnerable code processes the format-date shortcode without properly sanitizing or escaping user-supplied input. An authenticated attacker with contributor-level access or above can inject arbitrary JavaScript code via the shortcode attribute, which persists in the page content and executes in the browsers of all users who view that page. Exploitation requires an administrator to enable the wppb_toolbox_shortcodes_settings[format-date] option. The vulnerability affects all versions up to and including 4.0.0, and patches should be available in later releases.

Affected products

Cozmoslabs Profile Builder up to 4.0.0

Timeline

2026-09-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.