CVE-2026-42385 Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions

Description

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

Affected products and versions

Product	Affected versions	Fixed in
Profile Builder Pro 3.15	earliest → 3.15.0	No fix stated

Other CVEs of Profile Builder Pro

The 6 CVEs of Profile Builder Pro →

CVE-2026-7647 The Profile Builder Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including… 8.1 High CVE-2026-27413 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile… 9.3 Critical CVE-2024-22140 Cross-Site Request Forgery (CSRF) vulnerability in Cozmoslabs Profile Builder Pro.This issue affects Profile Builder… 8.8 High CVE-2024-22141 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cozmoslabs Profile Builder Pro.This issue… 6.5 Medium