Profile Builder Pro CVE-2026-42385

The target WordPress site must have Profile Builder Pro <= 3.15.0 installed and active, and must expose a Profile Builder-rendered form (registration, profile edit, or similar) to unauthenticated users - the typical deployment for the plugin. Exploitation requires user interaction (UI:R), meaning a victim, usually a logged-in administrator or another user with elevated rights, must load the page where the attacker's injected payload is rendered. No authentication is needed to inject (PR:N), but successful impact depends on an admin viewing the malicious content; sites that disable public registration or render Profile Builder forms only behind authentication materially reduce exposure.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L yields 7.1 (High) and reflects network-reachable, low-complexity, unauthenticated injection that nonetheless requires a victim to interact (UI:R) - typically an administrator viewing the malicious profile or form submission. No EPSS score, KEV listing, or public POC has been provided in the source data, suggesting opportunistic rather than mass exploitation today; Patchstack is the sole intelligence source. Practical risk is meaningful for any WordPress site running Profile Builder Pro <= 3.15.0 that allows public registration, because a single attacker submission can hijack an admin session and pivot to full site takeover. EPSS data is missing from the input - defenders should not interpret its absence as low likelihood.

An unauthenticated attacker submits a crafted value - for example a malicious payload in a registration or profile field rendered by Profile Builder Pro - that contains JavaScript. When a site administrator later views the submission, user list, or affected page in wp-admin, the script executes in their authenticated session and can create a new administrator account, exfiltrate nonces, or modify site content. No public POC has been identified at time of analysis.