User Profile Builder CVE-2026-6431

The User Profile Builder plugin must be installed and active, and the WordPress site must have open user registration enabled (allowing unauthenticated visitors to submit registration forms that include the Biographical Info field). Exploitation of the stored payload additionally requires that an authenticated user - ideally an administrator - visits the attacker's profile page after registration. Sites with closed registration or mandatory admin approval of new accounts reduce the unauthenticated injection vector, though authenticated contributor-level users could still inject payloads. The limiting factor for impact is victim interaction: a targeted lure (e.g., sending an admin a direct profile URL) is required to escalate from stored payload to session compromise.

The provided CVSS score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) captures the network-accessible, unauthenticated injection vector and scope change, but the UI:N metric is inconsistent with stored XSS behavior: a victim must actively visit the injected profile page, which maps to UI:R in standard CVSS 3.1 guidance. Adjusting to UI:R reduces the score to approximately 6.1, which more accurately reflects real-world exploitation difficulty. EPSS data is not provided, so base exploitation probability cannot be independently assessed. No CISA KEV listing and no public exploit code identified, indicating this is not known to be actively exploited at scale. Practical priority is medium-high for sites with open user registration: an unauthenticated attacker can pre-position a payload persistently, and a single admin visit to the profile triggers full session compromise. Sites with closed or approval-gated registration face lower exposure.

An unauthenticated attacker navigates to the WordPress site's open registration page, submits a new account with a JavaScript payload (such as a document.cookie exfiltration script) in the 'Biographical Info' field, and the payload is stored persistently in the database. A site administrator, responding to a notification about the new registration or clicking a direct link to the profile, views the attacker's profile page - the script executes in the admin's browser, exfiltrates the session cookie to an attacker-controlled server, and grants the attacker full administrative control over the WordPress installation.