EUVD-2026-72367
GHSA-5489-mc3f-rfqq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Stored XSS execution requires a victim to view the injected page (UI:R); all other metrics unchanged from network-accessible unauthenticated injection with browser-scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The User Profile Builder plugin must be installed and active, and the WordPress site must have open user registration enabled (allowing unauthenticated visitors to submit registration forms that include the Biographical Info field). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) captures the network-accessible, unauthenticated injection vector and scope change, but the UI:N metric is inconsistent with stored XSS behavior: a victim must actively visit the injected profile page, which maps to UI:R in standard CVSS 3.1 guidance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update User Profile Builder to the version incorporating WordPress.org SVN changeset 3511465 (https://plugins.trac.wordpress.org/changeset/3511465), which applies the necessary input sanitization and output escaping fixes in class-formbuilder.php and class-email-confirmation.php. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress instances using User Profile Builder plugin and verify their versions against the vulnerable range (≤3.15.7); enable enhanced security logging and monitoring for profile activities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor
View allStored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows aut
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to
User Profile Builder plugin for WordPress up to version 3.15.5 allows authenticated subscribers and above to reassign ow
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today