Profile Builder vulnerabilities

Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.

A vulnerability in the Profile Builder plugin up to 3.16.1 on WordPress in the wppb_ajax_simple_avatar function of /wp-admin/admin-ajax.php allows unrestricted file upload. The attack can be performed remotely, and the exploit is public.

An unauthenticated Broken Access Control vulnerability in the Profile Builder plugin (versions up to 3.16.5) allows an unauthenticated attacker to gain access to functions or data that should be protected.