Vulnerabilities in Cozmoslabs

48 results
Vexday analysis

Cozmoslabs apresenta 25 CVEs catalogadas, sendo 2 críticas, com 5 publicadas nos últimos 90 dias indicando atividade contínua de descoberta de falhas. Nenhuma vulnerabilidade está sob exploração ativa conhecida (KEV), reduzindo o risco imediato. A fraqueza dominante é CWE-352 (Cross-Site Request Forgery), típica de aplicações web, sugerindo necessidade de revisão de controles anti-CSRF nos produtos.

CVE-2025-8896MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2026-57348HIGHWordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2025-31088MEDIUMWordPress Paid Member Subscriptions plugin <= 2.14.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-61971LOWWordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2026-66701MEDIUMWordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-13054MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2026-39514HIGHWordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-3139MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar FieldEPSS 0.2%