Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Cozmoslabs — Vulnerabilities & Security Advisories 64

Browse all 64 CVE security advisories affecting Cozmoslabs. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Cozmoslabs operates as a software development firm specializing in mobile applications and enterprise solutions, primarily targeting Android and iOS platforms. With forty recorded Common Vulnerabilities and Exposures (CVEs), the company’s product portfolio has historically exhibited significant security deficiencies. The most prevalent vulnerability classes include remote code execution (RCE), cross-site scripting (XSS), and privilege escalation flaws, often stemming from inadequate input validation and improper access controls within their mobile frameworks. These issues frequently allow attackers to bypass authentication mechanisms or execute arbitrary commands on affected devices. While no single catastrophic data breach has been publicly attributed solely to Cozmoslabs, the high volume of CVEs indicates systemic weaknesses in their secure development lifecycle. The recurring nature of these vulnerabilities suggests a need for rigorous code auditing and enhanced security testing protocols to mitigate risks associated with their widely deployed software components.

CVE ID Title CVSS Severity Published
CVE-2026-97249 WordPress Paid Member Subscriptions plugin <= 3.0.9 - Bypass Vulnerability vulnerability — Paid Member Subscriptions CWE-290 5.3 Medium 2026-09-30
CVE-2026-96338 WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability — Profile Builder CWE-79 6.5 Medium 2026-09-30
CVE-2026-95866 User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor CWE-79 7.2 High 2026-09-25
CVE-2026-93656 User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor CWE-79 6.4 Medium 2026-09-25
CVE-2026-89412 TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel — TranslatePress – Translate Multilingual sites with AI Translation CWE-79 7.2 High 2026-09-22
CVE-2026-6431 User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor CWE-79 7.2 High 2026-09-07
CVE-2026-75964 User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor CWE-79 6.1 Medium 2026-09-01
CVE-2026-75965 User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor CWE-79 6.4 Medium 2026-09-01
CVE-2026-82607 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload — Profile Builder Plugin CWE-434 7.3 High 2026-08-31
CVE-2026-76053 TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser — TranslatePress – Translate Multilingual sites with AI Translation CWE-79 7.2 High 2026-08-28
CVE-2026-19632 TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure — TranslatePress – Translate Multilingual sites with AI Translation CWE-640 9.8 Critical 2026-08-26
CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor — TranslatePress – Translate Multilingual sites with AI Translation CWE-79 6.4 Medium 2026-08-25
CVE-2026-78267 WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability — TranslatePress CWE-266 9.8 Critical 2026-08-24
CVE-2026-66582 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability — TranslatePress CWE-79 7.1 High 2026-08-20
CVE-2026-75981 TranslatePress – Translate Multilingual sites with AI Translation <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting — TranslatePress – Translate Multilingual sites with AI Translation CWE-79 7.2 High 2026-08-19
CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor CWE-704 9.8 Critical 2026-08-15
CVE-2026-66701 WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability — Profile Builder CWE-862 5.3 Medium 2026-08-06
CVE-2026-18510 TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content — TranslatePress – Translate Multilingual sites with AI Translation CWE-79 7.2 High 2026-08-06
CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting — TranslatePress – Translate Multilingual sites with AI Translation CWE-79 6.1 Medium 2026-08-05
CVE-2026-59539 WordPress Paid Member Subscriptions plugin <= 3.0.7 - Insecure Direct Object References (IDOR) vulnerability — Paid Member Subscriptions CWE-639 7.5 High 2026-07-27
CVE-2026-61971 WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability — User Profile Picture CWE-639 2.7 Low 2026-07-13
CVE-2026-57348 WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability — Paid Member Subscriptions CWE-918 7.2 High 2026-07-02
CVE-2026-42385 WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability — Profile Builder Pro CWE-79 7.1 High 2026-06-17
CVE-2026-39514 WordPress Paid Member Subscriptions plugin <= 2.17.3 - Reflected Cross Site Scripting (XSS) vulnerability — Paid Member Subscriptions CWE-79 7.1 High 2026-06-15
CVE-2026-7647 Profile Builder Pro <= 3.14.5 - Unauthenticated PHP Object Injection — Profile Builder Pro CWE-502 8.1 High 2026-05-02
CVE-2026-3139 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field — User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor CWE-639 4.3 Medium 2026-03-31
CVE-2026-27413 WordPress Profile Builder Pro plugin < 3.14.0 - SQL Injection vulnerability — Profile Builder Pro CWE-89 9.3 Critical 2026-03-19
CVE-2025-68514 WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerability — Paid Member Subscriptions CWE-639 6.5 Medium 2026-02-20
CVE-2025-66074 WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability — WP Webhooks CWE-434 9.0 Critical 2025-12-18
CVE-2025-66073 WordPress WP Webhooks plugin <= 3.3.8 - PHP Object Injection vulnerability — WP Webhooks CWE-502 7.2 High 2025-11-21

This page lists every published CVE security advisory associated with Cozmoslabs. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.