CVE-2025-49292 MEDIUM

CVE-2025-49292: WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability

Vendor Cozmoslabs
Product Profile Builder
Weakness CWE-1284
Published June 6, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Builder: from n/a through <= 3.13.8.

Explanation of Vulnerability in Simple Terms

02Summary

Profile Builder versions up to 3.13.8 contain an input validation flaw that allows attackers to modify site content through user interaction. An attacker can craft a malicious link or page that, when visited by a site administrator or user, alters data on the site. The vulnerability requires no authentication but does require the victim to interact with attacker-controlled content. Update to a version newer than 3.13.8.

What an attacker can do

03Attacker Capabilities

Modify site content or data by tricking a user into clicking a malicious link.

Potential impact on your site

04Site Impact

Site content or user data could be altered without authorization if users click malicious links.

Conditions required to exploit

05Prerequisites

Victim must visit attacker-controlled page or click a malicious link; no login required.

Key dates

06Disclosure timeline

June 6, 2025 CVE published
April 28, 2026 Record updated