The User Profile Builder plugin for WordPress up to version 4.0.3 contains a privilege escalation vulnerability. Authenticated users with Author-level access or higher can assign themselves or others privileged roles such as Editor via the Gutenberg Register block due to improper server-side authorization. The vulnerability arises because the plugin does not adequately restrict role assignment for roles lacking certain high-level capabilities, allowing unauthorized role elevation.
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to allow unmoderated comment submission on at least one post and to have a secondary language configured — both conditions reflect TranslatePress's primary use case.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.
The User Profile Builder plugin for WordPress versions up to 4.0.3 contains a privilege escalation vulnerability via the 'role' parameter in the user registration form. This flaw allows unauthenticated attackers to create a fully activated administrator account by submitting a crafted registration request with 'role=administrator' and confirming via email. Exploitation requires legacy form fields named 'role', email confirmation enabled, and open user registration. The vulnerability arises from insufficient validation of the role parameter in the activation handler.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists in wp_comments.comment_author independently of the user account, so removing or changing the attacker's display name after the comment is posted does not neutralize the stored script.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user's Edit User screen.
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel (v-html on suggestion.original) in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated attackers can seed the translation dictionary's original column with executable HTML because the front-end rendering pipeline decodes entity-encoded payloads via html_entity_decode() before persistence, and the original column is deliberately exempt from kses filtering — meaning no save-time sanitizer neutralizes the stored payload before it is later rendered in an administrator's session.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manage_options capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by row_actions().
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.
CVE-2026-82607 is a medium severity vulnerability in the Cozmoslabs Profile Builder Plugin for WordPress, affecting versions 3.16.0 and 3.16.1. It involves an unrestricted file upload issue in the Avatar Simple Upload AJAX Handler function wppb_ajax_simple_avatar. This vulnerability can be exploited remotely without authentication. Upgrading to version 3.16.2 resolves the issue.
TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin versions up to and including 3.3.3 are vulnerable to stored cross-site scripting (XSS) via comment noise-key injection. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into pages. These scripts execute when users access the affected pages, leveraging WordPress's comment KSES allowlist that permits certain HTML tags and attributes. This vulnerability has a high severity rating with a CVSS score of 7.2.
TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress contains a critical vulnerability (CVE-2026-19632) that allows unauthenticated attackers to extract sensitive password-reset URLs. This occurs via the 'trp_get_translations_regular' AJAX action in all versions up to 3.3.1 when automatic string saving is enabled and the administrator's profile locale is set to a published secondary language. The vulnerability exposes the plaintext reset key and login parameters, enabling full administrator account takeover.
The TranslatePress – Translate Multilingual sites with AI Translation WordPress plugin versions up to and including 3.2.6 contain a stored cross-site scripting (XSS) vulnerability. This vulnerability arises from insufficient input sanitization and output escaping in the Approved Comment Body Rendered in the Translation Editor Strings Dropdown. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts that execute when other users access the affected pages.
CVE-2026-78267 is a critical vulnerability in Cozmoslabs TranslatePress versions up to and including 3.3.2. It allows unauthenticated users to escalate privileges due to incorrect privilege assignment (CWE-266). The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-66582 is a high-severity Cross-Site Scripting (XSS) vulnerability affecting TranslatePress versions up to and including 3.3.2. It allows unauthenticated attackers to inject malicious scripts during web page generation due to improper input neutralization. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of affected systems.