Published October 24, 2026. Based on public CVE records available on that date; details may change.

Four CVEs published on October 23 and 24, 2026 affect User Profile Builder by Cozmoslabs, a registration and profile plugin with 40,000+ active installations on WordPress.org. The most serious ones let a logged-in user with elevated access take over other accounts or create Editor-level accounts. Every issue requires an account on the site, and updating to version 4.0.5 or later covers all four.

What happened

WPScan published three of the records and Wordfence published the fourth. All four describe weaknesses that a user who is already logged in can abuse. None of them is described as exploitable by an anonymous visitor.

CVE-2026-111982: Multisite account takeover through Edit Profile

The record says the plugin's front-end Edit Profile form does not verify that the user is allowed to edit the specific account selected on the form. On a WordPress Multisite network, an Administrator of one subsite can change the email address on any other user's account, including a Network Super Admin's, and then take over that account through the password reset flow.

  • Who must be logged in: an Administrator of a Multisite subsite.
  • Affected: all versions before 4.0.5.
  • Score: 7.2 (High) from CISA's ADP enrichment, CVSS 3.1. WPScan's record carries no score of its own.

This one matters mainly on Multisite networks where subsite administrators are not fully trusted with the whole network, such as agencies hosting several clients on one install.

CVE-2026-111966: stored XSS through a shortcode attribute

One of the plugin's shortcode attributes is not sanitized or escaped before it is shown back in a redirect message. A user with Contributor access or higher can store script that runs in the browser of a higher-privileged user who submits the affected form.

  • Who must be logged in: Contributor or higher, and a higher-privileged user has to submit the form.
  • Affected: all versions before 4.0.5.
  • Score: 6.8 (Medium) from CISA's ADP enrichment, CVSS 3.1. WPScan's record carries no score of its own.

CVE-2026-111965: reCAPTCHA not enforced on comments

The plugin does not enforce its reCAPTCHA check on every comment submission path, so authenticated users can get around the anti-spam protection an administrator turned on for the WordPress comment form. The 4.0.5 changelog says the fix covers reCAPTCHA and Turnstile when comments arrive through XML-RPC or the REST API.

  • Who must be logged in: any authenticated user (the record's title says Subscriber or higher).
  • Affected: 4.0.0 up to, but not including, 4.0.5. Versions before 4.0.0 are not listed for this one.
  • Score: 4.3 (Medium) from WPScan, CVSS 3.1.

CVE-2026-115807: authors can create Editor accounts

The plugin's Register block for the block editor passes its Assigned Role setting into the registration shortcode without a server-side check. The plugin's role guard only downgrades roles that carry the manage_options or remove_users capability. That leaves Editor, and any other role without those two capabilities, open: an Author can publish a registration form that creates new accounts with that role.

  • Who must be logged in: Author or higher.
  • Affected: all versions up to and including 4.0.3. The record does not name a fixed release.
  • Score: 7.1 (High) from Wordfence, CVSS 3.1.

The 4.0.5 changelog includes a fix stating that a role set on a registration form inside post content can no longer grant capabilities the post author does not have.

Separately, an earlier record, CVE-2026-111948 (WPScan, published October 21, 2026), covers a reflected XSS issue against high-privilege users that was fixed in 4.0.1.

Exploitation status

CISA's enrichment on the three WPScan records, dated October 23, 2026, rates exploitation as none and automation as no. The Wordfence record for CVE-2026-115807 does not say whether it has been exploited. That status can change after disclosure.

Who is affected

Any site running User Profile Builder older than 4.0.5. Your real exposure depends on who has accounts:

  • Multisite networks with subsite administrators you do not fully trust: CVE-2026-111982.
  • Sites with Contributors or Authors from outside your team, such as guest writers or member content: CVE-2026-111966 and CVE-2026-115807.
  • Sites with open registration that rely on the plugin's reCAPTCHA or Turnstile for comments on 4.0.0 through 4.0.4: CVE-2026-111965.

Version 4.0.5 is the current release on WordPress.org, last updated October 19, 2026.

How to check your site

Start with the version.

  1. In the dashboard, go to Plugins, Installed Plugins and find User Profile Builder. On Multisite, check Network Admin, Plugins.
  2. With WP-CLI, run wp plugin get profile-builder --field=version. Anything below 4.0.5 needs the update.
  3. If you also run Profile Builder Pro or paid add-ons, note their versions too. The records do not cover them, so confirm with the vendor.

Then look for signs of abuse:

  • wp user list --role=editor --fields=ID,user_login,user_email,user_registered lists Editor accounts. Look for recent registrations nobody approved, which is the pattern CVE-2026-115807 enables.
  • wp user list --role=administrator --fields=ID,user_login,user_email lists administrators. On Multisite, wp super-admin list shows Network Super Admins; confirm each email address is one you recognize.
  • Review pages and posts that contain the plugin's Register block or registration shortcode, especially ones written by Authors.

Our guide to finding hidden admin users in WordPress walks through deeper account checks.

What to do now

Update first. Use Dashboard, Updates or run wp plugin update profile-builder, then confirm the version is 4.0.5 or later. On Multisite, update from the network admin.

If you cannot update right away:

  1. Review who holds Contributor, Author, and subsite Administrator roles, and remove access people no longer need. The WordPress hardening checklist covers role cleanup.
  2. Unpublish registration forms that you did not create or that assign a role above Subscriber.
  3. If a Super Admin or administrator email address changed without explanation, reset that account's password, restore the correct email, and run wp user session destroy USERNAME --all to end its sessions.

If you find accounts or email changes you cannot explain, assume the site may have been accessed. Take a backup to preserve evidence before cleaning, then rotate WordPress, hosting, and database passwords.

When to get help

Get help if you find unexpected Editor or administrator accounts, or a Super Admin email you did not change. Our WordPress malware removal service handles suspected compromises, and a security audit can review user roles and registration settings across a Multisite network.

Sources