Profile Builder CVE-2026-54855

Exploitation targets a site running Profile Builder plugin version 4.0.5 or earlier. Per the CVSS vector (PR:N), no authentication is required of the attacker, but successful exploitation REQUIRES victim user interaction (UI:R) - a user must click a crafted link or view attacker-supplied content for the script to execute in their browser. The specific vulnerable parameter, endpoint, and whether the injection is reflected or stored are not described in the available sources. Limiting factors: dependence on tricking a user into interaction, impact confined to the victim's browser context (Low C/I), and applicability only to the unpatched plugin versions.

This is a CWE-79 Cross-Site Scripting flaw in the Profile Builder WordPress plugin (Cozmoslabs) at versions <= 4.0.5, carrying a supplied CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The vector signals remote, low-complexity, unauthenticated (PR:N) exploitation, but critically requires user interaction (UI:R), which materially lowers real-world urgency versus a no-interaction flaw. The scope change (S:C) and the 'Unauthenticated' label are the main severity drivers; impacts are rated Low across C/I/A, consistent with typical XSS (session/credential theft or UI manipulation in the victim's browser rather than server compromise). Key decision signals are MISSING or weak: no EPSS score was provided, there is no CISA KEV listing, and no confirmed working exploit code - only a single Patchstack advisory reference. The vuln.today priority is 'this_week' (not act_now/emergency), aligning with a genuine-but-non-critical, interaction-dependent web bug. Conflicting note: the CVSS lists A:L (availability impact), which is atypical for reflected XSS and is not substantiated by the one-line description - verify with the Patchstack advisory. Overall: a real, patch-this-week issue for sites running the affected plugin, not a drop-everything emergency, and not confirmed to be under active exploitation.

An unauthenticated attacker crafts a malicious URL or payload targeting a vulnerable Profile Builder input/parameter and lures a logged-in site user or administrator into clicking it. When the victim's browser renders the unsanitized response, attacker-controlled JavaScript executes in the site's origin, enabling session/cookie theft or actions in the victim's context. No confirmed working exploit code is published; only a Patchstack advisory reference exists, and the precise injection point is not described in the available sources.