These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The User Profile Builder plugin for WordPress has a Limited Privilege Escalation vulnerability. Authenticated attackers with Author-level access can create new accounts with the Editor role. This vulnerability exists due to insufficient server-side authorization in the Gutenberg Register block, allowing the attacker-controlled Assigned Role attribute to be passed directly into the [wppb-register] shortcod [truncated]
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an i [truncated]
The User Profile Builder plugin for WordPress, version 4.0.3 and below, is vulnerable to Stored Cross-Site Scripting via the First Name Field. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, but only when the Email Confirmation feature is enabled in Profile Builder. Defenders should assess exposure an [truncated]
CVE-2026-109447 is a Privilege Escalation vulnerability in the User Profile Builder plugin for WordPress. The vulnerability exists in all versions up to, and including, 4.0.3. An unauthenticated attacker can exploit this vulnerability to gain a fully activated WordPress administrator account by submitting role=administrator through the public [wppb-register] shortcode form and subsequently clicking the co [truncated]
The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-103062 is a Stored Cross-site Scripting (XSS) vulnerability affecting TranslatePress versions up to 3.3.6. Defenders should assess exposure, prioritize remediation, and verify inventory for potential impact. The vulnerability has a high CVSS score of 7.1, indicating a high severity vulnerability. Defenders need to verify TranslatePress versions and apply patches or mitigations to prevent potentia [truncated]
The User Profile Builder plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the Avatar Field in versions up to 4.0.2. This allows unauthenticated attackers to inject web scripts that execute when a user accesses an injected page. The vulnerability exists due to insufficient input sanitization and output escaping, particularly in the wppb_save_avatar_value() function, which writes raw [truncated]
The User Profile Builder plugin for WordPress has a stored cross-site scripting vulnerability via the avatar field in versions up to 4.0.2. Authenticated attackers with subscriber-level access can inject web scripts that execute when a user accesses an injected page. This vulnerability requires verification from official sources to determine affected versions and remediation steps. The vulnerability allow [truncated]
The User Profile Builder plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7. This allows unauthenticated attackers to inject web scripts that execute when a user accesses an injected page. The vulnerability was reported by [email protected] and is documented in the CVE Program record and NV [truncated]
The Cozmoslabs Profile Builder Plugin up to version 3.16.1 for WordPress contains a medium severity vulnerability (CVSS score of 5.5) related to unrestricted file uploads via the Avatar Simple Upload AJAX Handler. This vulnerability, identified as CVE-2026-82607, can be exploited remotely and has been made public. Users of the affected plugin version should prioritize upgrading to version 3.16.2 or later. [truncated]
CVE-2026-78267 is a critical unauthenticated privilege escalation vulnerability in TranslatePress versions up to 3.3.2. Defenders should assess exposure, prioritize remediation, and verify vendor-provided fixes.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-06T15:17:22.987Z and has not been modified since then. The unauthenticated broken access control vulnerability in Profile Builder plugin version 3.16.5 or earlier poses a significant risk to affected deployments. This vulnerability could potentially allow unauthorized access to user profiles, which [truncated]
The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content (URL-encoded gettext markers) in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Comment moderat [truncated]
A HIGH severity vulnerability was found in Paid Member Subscriptions plugin version 3.0.7 and earlier. The vulnerability is an Insecure Direct Object References (IDOR) issue, which could allow attackers to access sensitive data. This issue affects users of Paid Member Subscriptions plugin version 3.0.7 and earlier. The vulnerability allows unauthenticated attackers to access sensitive data by manipulating [truncated]
A vulnerability was found in Cozmoslabs User Profile Picture metronet-profile-picture. It has been classified as problematic. Affected is an unknown function of the component User-Controlled Key Handler. The manipulation leads to authorization bypass. The issue affects User Profile Picture: from n/a through <= 2.6.3. This vulnerability allows attackers to bypass authorization due to incorrectly configured [truncated]
CVE-2026-42385 is a high-severity Unauthenticated Cross Site Scripting (XSS) vulnerability in Profile Builder Pro versions <= 3.15.0. The vulnerability has a CVSS score of 7.1 and is considered HIGH. It was published on 2026-06-17T13:20:40.067Z and last modified on 2026-06-17T15:16:50.517Z. Users of Profile Builder Pro should update to a patched version to prevent exploitation. The vulnerability allows at [truncated]
CVE-2026-39514 is a HIGH severity Unauthenticated Cross Site Scripting (XSS) vulnerability affecting Paid Member Subscriptions plugin versions <= 2.17.3. The vulnerability has a CVSS score of 7.1 and was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-39514). The vulnerability was reported by Patchstack.
