# Cozmoslabs Profile Builder vulnerabilities Source: https://junglewise.ai/threats/technologies/profile-builder Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 14:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/profile-builder.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Cozmoslabs Profile Builder: 2 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125776, was published on 11 November 2026. 6 vulnerabilities in the last four weeks, up 200% on the four before (2). ## Counts - Last 7 days: 2 - Last 30 days: 8 - Last 90 days: 13 - All time: 14 (0 critical, 0 exploited in the wild) ## About Cozmoslabs Profile Builder WordPress plugin for creating and managing user profile customization and registration forms. ## Latest Cozmoslabs Profile Builder vulnerabilities - [CVE-2026-125776: Cozmoslabs Profile Builder broken access control](https://junglewise.ai/threats/cve-2026-125776-missing-authorization-vulnerability-in-cozmoslabs-profile) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-125777: Cozmoslabs Profile Builder sensitive data exposure](https://junglewise.ai/threats/cve-2026-125777-insertion-of-sensitive-information-into-sent-data-vulnerability) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-54855: Profile Builder unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-54855-unauthenticated-cross-site-scripting-xss-in-profile-builder-4-0-5) (high, CVSS 7.1, published 30 Oct 2026) - [CVE-2026-54854: WordPress Profile Builder privilege escalation in user roles](https://junglewise.ai/threats/cve-2026-54854-contributor-privilege-escalation-in-profile-builder-4-0-5) (medium, CVSS 6.3, published 30 Oct 2026) - [CVE-2026-54853: Cozmoslabs Profile Builder broken access control vulnerability](https://junglewise.ai/threats/cve-2026-54853-missing-authorization-vulnerability-in-cozmoslabs-profile-builder) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-111982: Profile Builder WordPress plugin account takeover via unauthorized email edit](https://junglewise.ai/threats/cve-2026-111982-the-user-profile-builder-wordpress-plugin-before-4-0-5-does-not) (info, published 23 Oct 2026) - [CVE-2026-111966: Profile Builder stored cross-site scripting in shortcode attribute](https://junglewise.ai/threats/cve-2026-111966-the-user-profile-builder-wordpress-plugin-before-4-0-5-does-not) (info, published 23 Oct 2026) - [CVE-2026-112242: Cozmoslabs Profile Builder privilege escalation](https://junglewise.ai/threats/cve-2026-112242-incorrect-privilege-assignment-vulnerability-in-cozmoslabs) (high, CVSS 8.8, published 22 Oct 2026) - [CVE-2026-96338: Profile Builder cross-site scripting in subscriber profile](https://junglewise.ai/threats/cve-2026-96338-subscriber-cross-site-scripting-xss-in-profile-builder-4-0-2) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-95866: Profile Builder stored XSS in avatar field](https://junglewise.ai/threats/cve-2026-95866-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2026-75965: Profile Builder stored XSS via date shortcode attribute](https://junglewise.ai/threats/cve-2026-75965-profile-builder-stored-xss-via-date-shortcode-attribute) (medium, CVSS 6.4, published 1 Sep 2026) - [CVE-2026-82607: Cozmoslabs Profile Builder unrestricted file upload in avatar handler](https://junglewise.ai/threats/cve-2026-82607-cozmoslabs-profile-builder-unrestricted-file-upload-in-avatar) (high, CVSS 7.3, published 31 Aug 2026) - [CVE-2026-76547: User Profile Builder PHP Object Injection in import/export](https://junglewise.ai/threats/cve-2026-76547-user-profile-builder-php-object-injection-in-import-export) (medium, CVSS 6.6, published 29 Aug 2026) - [CVE-2026-66701: WordPress Profile Builder broken access control](https://junglewise.ai/threats/cve-2026-66701-wordpress-profile-builder-broken-access-control) (medium, CVSS 5.3, published 6 Aug 2026) ## Most severe Cozmoslabs Profile Builder vulnerabilities - [CVE-2026-112242: Cozmoslabs Profile Builder privilege escalation](https://junglewise.ai/threats/cve-2026-112242-incorrect-privilege-assignment-vulnerability-in-cozmoslabs) (high, CVSS 8.8, published 22 Oct 2026) - [CVE-2026-82607: Cozmoslabs Profile Builder unrestricted file upload in avatar handler](https://junglewise.ai/threats/cve-2026-82607-cozmoslabs-profile-builder-unrestricted-file-upload-in-avatar) (high, CVSS 7.3, published 31 Aug 2026) - [CVE-2026-95866: Profile Builder stored XSS in avatar field](https://junglewise.ai/threats/cve-2026-95866-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2026-54855: Profile Builder unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-54855-unauthenticated-cross-site-scripting-xss-in-profile-builder-4-0-5) (high, CVSS 7.1, published 30 Oct 2026) - [CVE-2026-76547: User Profile Builder PHP Object Injection in import/export](https://junglewise.ai/threats/cve-2026-76547-user-profile-builder-php-object-injection-in-import-export) (medium, CVSS 6.6, published 29 Aug 2026) - [CVE-2026-96338: Profile Builder cross-site scripting in subscriber profile](https://junglewise.ai/threats/cve-2026-96338-subscriber-cross-site-scripting-xss-in-profile-builder-4-0-2) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-75965: Profile Builder stored XSS via date shortcode attribute](https://junglewise.ai/threats/cve-2026-75965-profile-builder-stored-xss-via-date-shortcode-attribute) (medium, CVSS 6.4, published 1 Sep 2026) - [CVE-2026-54854: WordPress Profile Builder privilege escalation in user roles](https://junglewise.ai/threats/cve-2026-54854-contributor-privilege-escalation-in-profile-builder-4-0-5) (medium, CVSS 6.3, published 30 Oct 2026) - [CVE-2026-66701: WordPress Profile Builder broken access control](https://junglewise.ai/threats/cve-2026-66701-wordpress-profile-builder-broken-access-control) (medium, CVSS 5.3, published 6 Aug 2026) - [CVE-2026-125776: Cozmoslabs Profile Builder broken access control](https://junglewise.ai/threats/cve-2026-125776-missing-authorization-vulnerability-in-cozmoslabs-profile) (medium, CVSS 5.3, published 11 Nov 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, up 200% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Other Cozmoslabs technologies - [Cozmoslabs Paid Member Subscriptions](https://junglewise.ai/threats/technologies/paid-member-subscriptions): 11 vulnerabilities - [Cozmoslabs User Profile Builder](https://junglewise.ai/threats/technologies/user-profile-builder): 8 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Cozmoslabs Profile Builder vulnerabilities", https://junglewise.ai/threats/technologies/profile-builder, 11 November 2026.