CVE WatchNov 11, 2026

CVE-2026-125777

Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensi

CVSS

5.3

Medium

EPSS

—

KEV

—

Exploit Today

0-100

Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-201

EPSS · 30d

Not enough EPSS history yet.

Technical description

Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/profile-builder/vulnerability/wordpress-profile-builder-plugin-4-0-6-sensitive-data-exposure-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-126331—

—

———Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.3h CVE-2026-1257675.3 MED

—

———Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1.10h CVE-2026-1257665.3 MED

—

———Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.10h CVE-2026-1254355.3 MED

—

———Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.10h CVE-2026-1216746.1 MED

53.9%

——16Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.23h CVE-2026-1200067.5 HIG

29.4%

——9Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.1d