9.8
Critical
CVE-2025-15030 The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few…
Description
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access to their account
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| User Profile Builder 1.1 | 1.1.27 → < 3.15.2 | 3.15.2 |
Other CVEs of User Profile Builder
The 11 CVEs of User Profile Builder →
CVE-2026-111966
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes…
6.8
Medium
CVE-2026-111982
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific…
7.2
High
CVE-2026-111948
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a…
7.1
High
CVE-2026-76546
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes,…
6.8
Medium