# Cozmoslabs vulnerabilities Source: https://junglewise.ai/threats/vendors/cozmoslabs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/cozmoslabs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 38 vulnerabilities in Cozmoslabs: 4 in the last 7 days and 28 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125776, was published on 11 November 2026. 15 vulnerabilities in the last four weeks, up 200% on the four before (5). 3 technologies have a page of their own. ## Counts - Last 7 days: 4 - Last 30 days: 17 - Last 90 days: 28 - All time: 38 (1 critical, 0 exploited in the wild) ## About Cozmoslabs A software company specializing in WordPress plugins and tools for developers and site owners. ## Latest Cozmoslabs vulnerabilities - [CVE-2026-125776: Cozmoslabs Profile Builder broken access control](https://junglewise.ai/threats/cve-2026-125776-missing-authorization-vulnerability-in-cozmoslabs-profile) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-125777: Cozmoslabs Profile Builder sensitive data exposure](https://junglewise.ai/threats/cve-2026-125777-insertion-of-sensitive-information-into-sent-data-vulnerability) (medium, CVSS 5.3, published 11 Nov 2026) - [CVE-2026-121765: Cozmoslabs TranslatePress multilingual stored XSS](https://junglewise.ai/threats/cve-2026-121765-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 7 Nov 2026) - [CVE-2026-119523: Cozmoslabs Paid Member Subscriptions broken access control vulnerability](https://junglewise.ai/threats/cve-2026-119523-missing-authorization-vulnerability-in-cozmoslabs-paid-member) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-119521: Cozmoslabs Paid Member Subscriptions stored cross-site scripting](https://junglewise.ai/threats/cve-2026-119521-improper-neutralization-of-input-during-web-page-generation) (medium, CVSS 6.5, published 3 Nov 2026) - [CVE-2026-54855: Profile Builder unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-54855-unauthenticated-cross-site-scripting-xss-in-profile-builder-4-0-5) (high, CVSS 7.1, published 30 Oct 2026) - [CVE-2026-54854: WordPress Profile Builder privilege escalation in user roles](https://junglewise.ai/threats/cve-2026-54854-contributor-privilege-escalation-in-profile-builder-4-0-5) (medium, CVSS 6.3, published 30 Oct 2026) - [CVE-2026-54853: Cozmoslabs Profile Builder broken access control vulnerability](https://junglewise.ai/threats/cve-2026-54853-missing-authorization-vulnerability-in-cozmoslabs-profile-builder) (medium, CVSS 5.3, published 29 Oct 2026) - [CVE-2026-111982: Profile Builder WordPress plugin account takeover via unauthorized email edit](https://junglewise.ai/threats/cve-2026-111982-the-user-profile-builder-wordpress-plugin-before-4-0-5-does-not) (info, published 23 Oct 2026) - [CVE-2026-111966: Profile Builder stored cross-site scripting in shortcode attribute](https://junglewise.ai/threats/cve-2026-111966-the-user-profile-builder-wordpress-plugin-before-4-0-5-does-not) (info, published 23 Oct 2026) - [CVE-2026-109936: Otter Blocks WordPress plugin stored XSS in dynamic content rendering](https://junglewise.ai/threats/cve-2026-109936-the-otter-blocks-wordpress-plugin-before-3-2-8-does-not) (info, published 23 Oct 2026) - [CVE-2026-112842: Cozmoslabs Paid Member Subscriptions broken access control](https://junglewise.ai/threats/cve-2026-112842-missing-authorization-vulnerability-in-cozmoslabs-paid-member) (medium, CVSS 6.5, published 22 Oct 2026) - [CVE-2026-112242: Cozmoslabs Profile Builder privilege escalation](https://junglewise.ai/threats/cve-2026-112242-incorrect-privilege-assignment-vulnerability-in-cozmoslabs) (high, CVSS 8.8, published 22 Oct 2026) - [CVE-2026-111948: User Profile Builder reflected XSS in admin page](https://junglewise.ai/threats/cve-2026-111948-the-user-profile-builder-wordpress-plugin-before-4-0-1-does-not) (info, published 21 Oct 2026) - [CVE-2026-109447: User Profile Builder privilege escalation via role parameter](https://junglewise.ai/threats/cve-2026-109447-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 8.1, published 16 Oct 2026) - [CVE-2026-107748: User Profile Builder display_name stored XSS](https://junglewise.ai/threats/cve-2026-107748-the-user-profile-builder-beautiful-user-registration-forms-user) (medium, CVSS 6.4, published 16 Oct 2026) - [CVE-2026-100186: User Profile Builder stored cross-site scripting in first name field](https://junglewise.ai/threats/cve-2026-100186-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 7.2, published 16 Oct 2026) - [CVE-2026-105317: Paid Member Subscriptions SQL injection in subscriber panel](https://junglewise.ai/threats/cve-2026-105317-subscriber-sql-injection-in-paid-member-subscriptions-3-1-1) (high, CVSS 8.5, published 6 Oct 2026) - [CVE-2026-103062: Cozmoslabs TranslatePress stored cross-site scripting](https://junglewise.ai/threats/cve-2026-103062-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 4 Oct 2026) - [CVE-2026-97249: Paid Member Subscriptions unauthenticated bypass](https://junglewise.ai/threats/cve-2026-97249-unauthenticated-bypass-vulnerability-in-paid-member-subscriptions) (medium, CVSS 5.3, published 30 Sep 2026) - [CVE-2026-96338: Profile Builder cross-site scripting in subscriber profile](https://junglewise.ai/threats/cve-2026-96338-subscriber-cross-site-scripting-xss-in-profile-builder-4-0-2) (medium, CVSS 6.5, published 30 Sep 2026) - [CVE-2026-95866: Profile Builder stored XSS in avatar field](https://junglewise.ai/threats/cve-2026-95866-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2026-75965: Profile Builder stored XSS via date shortcode attribute](https://junglewise.ai/threats/cve-2026-75965-profile-builder-stored-xss-via-date-shortcode-attribute) (medium, CVSS 6.4, published 1 Sep 2026) - [CVE-2026-82607: Cozmoslabs Profile Builder unrestricted file upload in avatar handler](https://junglewise.ai/threats/cve-2026-82607-cozmoslabs-profile-builder-unrestricted-file-upload-in-avatar) (high, CVSS 7.3, published 31 Aug 2026) - [CVE-2026-76548: User Profile Builder authentication bypass in file upload](https://junglewise.ai/threats/cve-2026-76548-user-profile-builder-authentication-bypass-in-file-upload) (high, CVSS 8.2, published 29 Aug 2026) ## Most severe Cozmoslabs vulnerabilities - [CVE-2026-78267: TranslatePress privilege escalation in multilingual plugin](https://junglewise.ai/threats/cve-2026-78267-translatepress-privilege-escalation-in-multilingual-plugin) (critical, CVSS 9.8, published 24 Aug 2026) - [CVE-2026-112242: Cozmoslabs Profile Builder privilege escalation](https://junglewise.ai/threats/cve-2026-112242-incorrect-privilege-assignment-vulnerability-in-cozmoslabs) (high, CVSS 8.8, published 22 Oct 2026) - [CVE-2026-105317: Paid Member Subscriptions SQL injection in subscriber panel](https://junglewise.ai/threats/cve-2026-105317-subscriber-sql-injection-in-paid-member-subscriptions-3-1-1) (high, CVSS 8.5, published 6 Oct 2026) - [CVE-2026-76548: User Profile Builder authentication bypass in file upload](https://junglewise.ai/threats/cve-2026-76548-user-profile-builder-authentication-bypass-in-file-upload) (high, CVSS 8.2, published 29 Aug 2026) - [CVE-2026-109447: User Profile Builder privilege escalation via role parameter](https://junglewise.ai/threats/cve-2026-109447-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 8.1, published 16 Oct 2026) - [CVE-2026-59539: Cozmoslabs Paid Member Subscriptions IDOR in Subscriber component](https://junglewise.ai/threats/cve-2026-59539-cozmoslabs-paid-member-subscriptions-idor-in-subscriber-component) (high, CVSS 7.5, published 27 Jul 2026) - [CVE-2026-82607: Cozmoslabs Profile Builder unrestricted file upload in avatar handler](https://junglewise.ai/threats/cve-2026-82607-cozmoslabs-profile-builder-unrestricted-file-upload-in-avatar) (high, CVSS 7.3, published 31 Aug 2026) - [CVE-2026-95866: Profile Builder stored XSS in avatar field](https://junglewise.ai/threats/cve-2026-95866-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 7.2, published 25 Sep 2026) - [CVE-2026-100186: User Profile Builder stored cross-site scripting in first name field](https://junglewise.ai/threats/cve-2026-100186-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 7.2, published 16 Oct 2026) - [CVE-2026-57348: Cozmoslabs Paid Member Subscriptions SSRF in WordPress plugin](https://junglewise.ai/threats/cve-2026-57348-cozmoslabs-paid-member-subscriptions-ssrf-in-wordpress-plugin) (high, CVSS 7.2, published 2 Jul 2026) ## Vulnerabilities per week 15 vulnerabilities in the last four weeks, up 200% on the four before (5). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 4 | 1 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 6 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Cozmoslabs technologies - [Cozmoslabs Profile Builder](https://junglewise.ai/threats/technologies/profile-builder): 14 vulnerabilities - [Cozmoslabs Paid Member Subscriptions](https://junglewise.ai/threats/technologies/paid-member-subscriptions): 11 vulnerabilities - [Cozmoslabs User Profile Builder](https://junglewise.ai/threats/technologies/user-profile-builder): 8 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Cozmoslabs vulnerabilities", https://junglewise.ai/threats/vendors/cozmoslabs, 12 November 2026.