CVE-2015-9337: Cozmoslabs Profile Builder

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.

Affected products

• Cozmoslabs Profile Builder: before 2.1.4 (fixed in 2.1.4)

Published 2019-08-22. Last modified 2026-06-17.