Cozmoslabs vulnerabilities
81 CVEs and advisories name Cozmoslabs as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121765WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-119523WordPress Paid Member Subscriptions plugin <= 3.1.3 - Broken Access Control vulnerability
- CVE-2026-120537TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint
- CVE-2026-119167TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE…
- CVE-2026-119521WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54855WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-54854WordPress Profile Builder plugin <= 4.0.5 - Privilege Escalation vulnerability
- CVE-2026-54853WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability
- CVE-2026-115807User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
- CVE-2026-112842WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability
- CVE-2026-112242WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability
- CVE-2026-107768TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
- CVE-2026-100186User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
- CVE-2026-109447User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]
- CVE-2026-107748User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
- CVE-2026-105317WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability
- CVE-2026-103062WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97249WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability
- CVE-2026-96338WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-95866User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
- CVE-2026-93656User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
- CVE-2026-89412TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
- CVE-2026-6431User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
- CVE-2026-75964User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
- CVE-2026-75965User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
- CVE-2026-82607Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload
- CVE-2026-76053TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
- CVE-2026-19632TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
- CVE-2026-18512TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
- CVE-2026-78267WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability