Skip to content
PluginCanary

User Profile Builder

User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor
by Cozmoslabs · 40,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 29 Oct 2026, 48 releases in 24 months, no unpatched vulnerabilities.

83/ 100 Canary Score
Sub-scores for User Profile Builder
Ownership100
Maintenance100
Security60
Support86
Reputation70

How the score works

Quick answers

Is User Profile Builder still maintained?
Yes. Last release 29 Oct 2026, 48 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns User Profile Builder, and has it changed hands?
No change recorded. Main committer madalin.ungureanu since Dec 2014. 4 Nov 2026 · SVN log
Was User Profile Builder removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is User Profile Builder safe?
58 known vulnerabilities, all fixed (latest in 4.0.6). Not on the exploited list. 30 Oct 2026 · Wordfence Intelligence
Is the latest User Profile Builder update safe to install?
No ownership change before 4.0.6. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
madalin.ungureanu15 Dec 2014 to 22 Apr 2026, 156 commits
sareiodata3 Mar 2017 to 19 Nov 2019, 6 commits
raster0222 Mar 2021 to 29 Oct 2026, 144 commits

3 committers recorded. No ownership change since 2011.

Maintenance

Last release
6 days ago
Releases, 24 months
48
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for User Profile Builder
Q1 20245
Q2 20244
Q3 20247
Q4 20245
Q1 20257
Q2 20254
Q3 20256
Q4 20256
Q1 20264
Q2 20266
Q3 20268
Q4 20263

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 4.0 (4 reviews). Lifetime: 4.7.

Average rating per quarter for User Profile Builder
Q4 20244.7
Q1 20254.4
Q2 20255.0
Q3 20255.0
Q4 20255.0
Q1 20265.0
Q2 20265.0
Q3 20263.7
Q4 20265.0

Average rating rose from 4.7 to 5.0 between Q4 2024 and Q4 2026.

Rating distribution
5 star651
4 star34
3 star17
2 star11
1 star25
Latest low reviews

Security record

33 vulnerabilities in 24 months (58 on record), all patched (latest fixed in 4.0.6).

Show 58 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Authenticated (Contributor+) Privilege Escalation6.3<= 4.0.54.0.6Patched before disclosure
30 Oct 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting7.2<= 4.0.54.0.6Patched before disclosure
29 Oct 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Missing Authorization5.3<= 4.0.54.0.6Patched before disclosure
23 Oct 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4< 4.0.54.0.5Patched before disclosure
23 Oct 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.5 - Missing Authorization2.7< 4.0.54.0.5Patched before disclosure
21 Oct 2026Profile Builder 4.0.0 - 4.0.4 - Authenticated (Subscriber+) Comment reCAPTCHA Protection Bypass4.34.0.0 to 4.0.44.0.5Patched before disclosure
20 Oct 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute7.1<= 4.0.34.0.4Patched before disclosure
20 Oct 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.4 - Authenticated (Author+) Privilege Escalation6.3<= 4.0.44.0.5Patched before disclosure
19 Oct 2026Profile Builder <= 4.0.0 - Reflected Cross-Site Scripting6.1<= 4.0.04.0.1Patched before disclosure
15 Oct 2026User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter6.4<= 4.0.34.0.4Patched before disclosure
15 Oct 2026User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]8.1<= 4.0.34.0.4Patched before disclosure
15 Oct 2026User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field7.2<= 4.0.34.0.4Patched before disclosure
24 Sep 2026User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field7.2<= 4.0.24.0.3Patched before disclosure
24 Sep 2026User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field6.4<= 4.0.24.0.3Patched before disclosure
24 Sep 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 4.0.24.0.3Patched before disclosure
6 Sep 2026User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field7.2<= 3.15.73.15.8Patched before disclosure
31 Aug 2026User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter6.1<= 4.0.04.0.1Patched before disclosure
31 Aug 2026User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute6.4<= 4.0.04.0.1Patched before disclosure
31 Aug 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Missing Authorization5.3< 4.0.14.0.1Patched before disclosure
30 Aug 2026Profile Builder < 3.16.1 - Unauthenticated Limited File Upload5.3<= 3.16.13.16.2Patched before disclosure
29 Aug 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4< 4.0.14.0.1Patched before disclosure
29 Aug 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor < 4.0.1 - Authenticated (Administrator+) PHP Object Injection6.6< 4.0.14.0.1Patched before disclosure
14 Aug 2026User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter9.8<= 3.16.43.16.5Patched before disclosure
29 Jul 2026User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.16.5 - Missing Authorization5.3<= 3.16.53.16.6Patched before disclosure
17 Jul 2026Profile Builder <= 3.16.3 - Privilege Escalation to Unauthenticated Account Takeover7.3<= 3.16.33.16.4Patched before disclosure

Changelog mentions of security fixes: 3.16.1 (nonce); 3.16.2 (security); 3.16.3 (security); 3.16.4 (security); 3.16.5 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

86% of 14 support threads resolved in the last 2 months.

Momentum

40,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for User Profile Builder
4 May 20261,079
11 May 20263,247
18 May 202622,342
25 May 20264,794
1 Jun 20263,101
8 Jun 202618,998
15 Jun 20264,840
22 Jun 20263,112
29 Jun 20262,854
6 Jul 202621,601
13 Jul 202636,777
20 Jul 20265,183
27 Jul 202621,432
3 Aug 20266,828
10 Aug 20263,759
17 Aug 202623,469
24 Aug 202621,865
31 Aug 20267,011
7 Sep 20263,150
14 Sep 202622,510
21 Sep 202624,541
28 Sep 20264,836
5 Oct 20264,097
12 Oct 202622,250
19 Oct 202624,514
26 Oct 202624,359
2 Nov 20261,848

Weekly downloads over the last 4 weeks are 43% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Gravatar EnhancedScore 100 · 100,000+WP User AvatarsScore 100 · 20,000+One User AvatarScore 96 · 100,000+Simple Local AvatarsScore 96 · 100,000+LoginWP (Formerly Peter's LoginScore 96 · 80,000+

Facts

Version4.0.6
AuthorCozmoslabs
Added13 Apr 2011
Last updated29 Oct 2026
Active installs40,000+
Requires WordPress3.1
Tested up to7.1.4
Requires PHP7.4
CategoryUser Management & Authentication > User Registration & Login
Tagsprofile, registration, user profile, User Registration, user registration form

Other plugins by this author: TranslatePress - Translate Multilingual sites with AI Translation, User Profile Picture, WP Webhooks - Automate repetitive tasks by creating powerful automation workflows directly within WordPress, Paid Membership Subscriptions - Effortless Memberships, Recurring Payments & Content Restriction, WP Webhooks - Contact Form 7 Integration, WPWH - WP Reset Webhook Integration, WP Webhooks - Email integration, WP Webhooks - Comments, WP Webhooks - Easy Digital Downloads, WP Webhooks - Manage Taxonomy Terms

Questions

Is User Profile Builder still maintained?

Yes. Last release 29 Oct 2026, 48 releases in the last 24 months.

Who owns User Profile Builder, and has it changed hands?

No change recorded. Main committer madalin.ungureanu since Dec 2014.

Was User Profile Builder removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is User Profile Builder safe?

58 known vulnerabilities, all fixed (latest in 4.0.6). Not on the exploited list.

Is the latest User Profile Builder update safe to install?

No ownership change before 4.0.6. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue