# cve.now: Cozmoslabs

The newest entries naming Cozmoslabs as an affected vendor (up to 200), of 81 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121765](https://cve.now/CVE-2026-121765.md): WordPress TranslatePress plugin \<= 3.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-119523](https://cve.now/CVE-2026-119523.md): WordPress Paid Member Subscriptions plugin \<= 3.1.3 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-120537](https://cve.now/CVE-2026-120537.md): TranslatePress \<= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Attribute via trp-ajax.php Dictionary Endpoint (CVSS 7.2)
- [CVE-2026-119167](https://cve.now/CVE-2026-119167.md): TranslatePress \<= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE… (CVSS 7.2)
- [CVE-2026-119521](https://cve.now/CVE-2026-119521.md): WordPress Paid Member Subscriptions plugin \<= 3.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-54855](https://cve.now/CVE-2026-54855.md): WordPress Profile Builder plugin \<= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-54854](https://cve.now/CVE-2026-54854.md): WordPress Profile Builder plugin \<= 4.0.5 - Privilege Escalation vulnerability (CVSS 6.3)
- [CVE-2026-54853](https://cve.now/CVE-2026-54853.md): WordPress Profile Builder plugin \<= 4.0.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-115807](https://cve.now/CVE-2026-115807.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute (CVSS 7.1)
- [CVE-2026-112842](https://cve.now/CVE-2026-112842.md): WordPress Paid Member Subscriptions plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-112242](https://cve.now/CVE-2026-112242.md): WordPress Profile Builder plugin \<= 4.0.4 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2026-107768](https://cve.now/CVE-2026-107768.md): TranslatePress \<= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers (CVSS 7.2)
- [CVE-2026-100186](https://cve.now/CVE-2026-100186.md): User Profile Builder \<= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field (CVSS 7.2)
- [CVE-2026-109447](https://cve.now/CVE-2026-109447.md): User Profile Builder \<= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on \[wppb-register\] (CVSS 8.1)
- [CVE-2026-107748](https://cve.now/CVE-2026-107748.md): User Profile Builder \<= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display\_name' Parameter (CVSS 6.4)
- [CVE-2026-105317](https://cve.now/CVE-2026-105317.md): WordPress Paid Member Subscriptions plugin \<= 3.1.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-103062](https://cve.now/CVE-2026-103062.md): WordPress TranslatePress plugin \<= 3.3.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-97249](https://cve.now/CVE-2026-97249.md): WordPress Paid Member Subscriptions plugin \<= 3.0.9 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2026-96338](https://cve.now/CVE-2026-96338.md): WordPress Profile Builder plugin \<= 4.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-95866](https://cve.now/CVE-2026-95866.md): User Profile Builder \<= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field (CVSS 7.2)
- [CVE-2026-93656](https://cve.now/CVE-2026-93656.md): User Profile Builder \<= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field (CVSS 6.4)
- [CVE-2026-89412](https://cve.now/CVE-2026-89412.md): TranslatePress \<= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel (CVSS 7.2)
- [CVE-2026-6431](https://cve.now/CVE-2026-6431.md): User Profile Builder \<= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field (CVSS 7.2)
- [CVE-2026-75964](https://cve.now/CVE-2026-75964.md): User Profile Builder \<= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter (CVSS 6.1)
- [CVE-2026-75965](https://cve.now/CVE-2026-75965.md): User Profile Builder \<= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-82607](https://cve.now/CVE-2026-82607.md): Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb\_ajax\_simple\_avatar unrestricted upload (CVSS 6.9)
- [CVE-2026-76053](https://cve.now/CVE-2026-76053.md): TranslatePress \<= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser (CVSS 7.2)
- [CVE-2026-19632](https://cve.now/CVE-2026-19632.md): TranslatePress – Multilingual \<= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure (CVSS 9.8)
- [CVE-2026-18512](https://cve.now/CVE-2026-18512.md): TranslatePress \<= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor (CVSS 6.4)
- [CVE-2026-78267](https://cve.now/CVE-2026-78267.md): WordPress TranslatePress plugin \<= 3.3.2 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-66582](https://cve.now/CVE-2026-66582.md): WordPress TranslatePress plugin \<= 3.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-75981](https://cve.now/CVE-2026-75981.md): TranslatePress – Translate Multilingual sites with AI Translation \<= 3.2.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2026-15826](https://cve.now/CVE-2026-15826.md): User Profile Builder \<= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter (CVSS 9.8)
- [CVE-2026-66701](https://cve.now/CVE-2026-66701.md): WordPress Profile Builder plugin \<= 3.16.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-18510](https://cve.now/CVE-2026-18510.md): TranslatePress \<= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2)
- [CVE-2026-17505](https://cve.now/CVE-2026-17505.md): TranslatePress \<= 3.2.5 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2026-59539](https://cve.now/CVE-2026-59539.md): WordPress Paid Member Subscriptions plugin \<= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability (CVSS 7.5)
- [CVE-2026-61971](https://cve.now/CVE-2026-61971.md): WordPress User Profile Picture plugin \<= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 2.7)
- [CVE-2026-57348](https://cve.now/CVE-2026-57348.md): WordPress Paid Member Subscriptions plugin \<= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2)
- [CVE-2026-42385](https://cve.now/CVE-2026-42385.md): WordPress Profile Builder Pro plugin \<= 3.15.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-39514](https://cve.now/CVE-2026-39514.md): WordPress Paid Member Subscriptions plugin \<= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-7647](https://cve.now/CVE-2026-7647.md): Profile Builder Pro \<= 3.14.5 - Unauthenticated PHP Object Injection (CVSS 8.1)
- [CVE-2026-3139](https://cve.now/CVE-2026-3139.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field (CVSS 4.3)
- [CVE-2026-27413](https://cve.now/CVE-2026-27413.md): WordPress Profile Builder Pro plugin \< 3.14.0 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-68514](https://cve.now/CVE-2025-68514.md): WordPress Paid Member Subscriptions plugin \<= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2025-66074](https://cve.now/CVE-2025-66074.md): WordPress WP Webhooks plugin \<= 3.3.8 - Arbitrary File Upload vulnerability (CVSS 9.0)
- [CVE-2025-66073](https://cve.now/CVE-2025-66073.md): WordPress WP Webhooks plugin \<= 3.3.8 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2025-13054](https://cve.now/CVE-2025-13054.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-58592](https://cve.now/CVE-2025-58592.md): WordPress TranslatePress Plugin \<= 2.10.2 - Deserialization of untrusted data Vulnerability (CVSS 8.1)
- [CVE-2025-11835](https://cve.now/CVE-2025-11835.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal (CVSS 5.3)
- [CVE-2025-58600](https://cve.now/CVE-2025-58600.md): WordPress Paid Member Subscriptions Plugin \<= 2.15.9 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-8895](https://cve.now/CVE-2025-8895.md): WP Webhooks \<= 3.3.5 - Unauthenticated Arbitrary File Copy (CVSS 9.8)
- [CVE-2025-54017](https://cve.now/CVE-2025-54017.md): WordPress Paid Member Subscriptions \<= 2.15.4 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-8896](https://cve.now/CVE-2025-8896.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-49870](https://cve.now/CVE-2025-49870.md): WordPress Paid Member Subscriptions plugin \<= 2.15.1 - SQL Injection Vulnerability (CVSS 7.5)
- [CVE-2025-49292](https://cve.now/CVE-2025-49292.md): WordPress Profile Builder plugin \<= 3.13.8 - Content Spoofing Vulnerability (CVSS 4.3)
- [CVE-2025-4671](https://cve.now/CVE-2025-4671.md): Profile Builder \<= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user\_meta and compare Shortcodes (CVSS 6.4)
- [CVE-2025-2314](https://cve.now/CVE-2025-2314.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-31088](https://cve.now/CVE-2025-31088.md): WordPress Paid Member Subscriptions plugin \<= 2.14.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-30773](https://cve.now/CVE-2025-30773.md): WordPress TranslatePress plugin \<= 2.9.6 - PHP Object Injection Vulnerability (CVSS 7.2)
- [CVE-2024-12919](https://cve.now/CVE-2024-12919.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.13.7 - Authentication Bypass via pms\_payment\_id (CVSS 9.8)
- [CVE-2024-12738](https://cve.now/CVE-2024-12738.md): User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor \<= 3.12.9 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-11291](https://cve.now/CVE-2024-11291.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-10261](https://cve.now/CVE-2024-10261.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2024-9222](https://cve.now/CVE-2024-9222.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.12.8 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-5639](https://cve.now/CVE-2024-5639.md): User Profile Picture \<= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update (CVSS 4.3)
- [CVE-2024-31341](https://cve.now/CVE-2024-31341.md): WordPress User Profile Builder plugin \<= 3.11.2 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2024-32728](https://cve.now/CVE-2024-32728.md): WordPress Paid Membership Subscriptions plugin \<= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2023-51522](https://cve.now/CVE-2023-51522.md): WordPress Paid Membership Subscriptions plugin \<= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-1389](https://cve.now/CVE-2024-1389.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.11.1 - Missing Authorization via pms\_stripe\_connect\_handle\_authorization\_return (CVSS 5.3)
- [CVE-2024-1390](https://cve.now/CVE-2024-1390.md): Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \<= 2.11.1 - Missing Authorization via creating\_pricing\_table\_page (CVSS 4.3)
- [CVE-2024-0324](https://cve.now/CVE-2024-0324.md): User Profile Builder \<= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb\_two\_factor\_authentication\_settings\_update (CVSS 8.2)
- [CVE-2024-22140](https://cve.now/CVE-2024-22140.md): WordPress Profile Builder Pro Plugin \<= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8)
- [CVE-2024-22141](https://cve.now/CVE-2024-22141.md): WordPress Profile Builder Pro Plugin \<= 3.10.0 is vulnerable to Sensitive Data Exposure (CVSS 6.5)
- [CVE-2024-22142](https://cve.now/CVE-2024-22142.md): WordPress Profile Builder Pro Plugin \<= 3.10.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-6504](https://cve.now/CVE-2023-6504.md): Profile Builder \<= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user\_meta Shortcode (CVSS 4.3)
- [CVE-2023-47669](https://cve.now/CVE-2023-47669.md): WordPress Profile Builder Plugin \<= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-2297](https://cve.now/CVE-2023-2297.md): Profile Builder – User Profile & User Registration Forms \<= 3.9.0 - Insecure Password Reset Mechanism (CVSS 9.8)
- [CVE-2023-0814](https://cve.now/CVE-2023-0814.md): Profile Builder – User Profile & User Registration Forms \<= 3.9.0 - Sensitive Information Disclosure via Shortcode (CVSS 6.5)
- [CVE-2021-36915](https://cve.now/CVE-2021-36915.md): WordPress Profile Builder plugin \<= 3.6.0 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.2)
- [CVE-2022-0653](https://cve.now/CVE-2022-0653.md): Profile Builder – User Profile & User Registration Forms \<= 3.6.1 Reflected Cross-Site Scripting (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cozmoslabs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.