Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage

Cozmoslabs vulnerabilities

77 published CVEs name Cozmoslabs among the affected products.

All 77 in the listAtom feed of new CVEs
Published CVEs
77
Last 12 months
45
Critical
8
Known exploited
0

Critical 8High 29Medium 39Low 1Not scored 0

CVEs per yearBy the year they were published

  1. 20222
  2. 20233
  3. 202414
  4. 202517
  5. 202641

Newest CVEs

  • CVE-2026-119521

    WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability

    Cozmoslabs · Paid Member Subscriptions

    Medium6.5
  • CVE-2026-54855

    WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

    Cozmoslabs · Profile Builder

    High7.1
  • CVE-2026-54854

    WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability

    Cozmoslabs · Profile Builder

    Medium6.3
  • CVE-2026-54853

    WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability

    Cozmoslabs · Profile Builder

    Medium5.3
  • CVE-2026-115807

    User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute

    cozmoslabs · User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

    High7.1
  • CVE-2026-112842

    WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability

    Cozmoslabs · Paid Member Subscriptions

    Medium6.5
  • CVE-2026-112242

    WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability

    Cozmoslabs · Profile Builder

    High8.8
  • CVE-2026-107768

    TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

    cozmoslabs · TranslatePress – Translate Multilingual sites with AI Translation

    High7.2
  • CVE-2026-100186

    User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field

    cozmoslabs · User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

    High7.2
  • CVE-2026-109447

    User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

    cozmoslabs · User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

    High8.1

Products with the most CVEs

  1. User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor21
  2. Paid Member Subscriptions14
  3. Profile Builder8
  4. TranslatePress – Translate Multilingual sites with AI Translation8
  5. Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction7
  6. Profile Builder Pro6
  7. TranslatePress5
  8. User Profile Picture2
  9. WP Webhooks2
  10. Profile Builder Plugin1

Most common weaknesses

  1. CWE-79 Cross-site scripting (XSS)30
  2. CWE-862 Missing authorization9
  3. CWE-639 Authorization bypass through a user-controlled key (IDOR)6
  4. CWE-352 Cross-site request forgery (CSRF)5
  5. CWE-502 Deserialization of untrusted data4
  6. CWE-200 Exposure of sensitive information3
  7. CWE-266 3
  8. CWE-89 SQL injection3
  9. CWE-269 Improper privilege management2
  10. CWE-284 Improper access control2