User Profile Builder CVE-2026-75965

Exploitation requires three concurrent conditions: (1) the attacker must hold a WordPress contributor-level account or higher on the target site - unauthenticated exploitation is not possible per CVSS PR:L; (2) an administrator must have explicitly set the wppb_toolbox_shortcodes_settings[format-date] option to 'yes', which is a non-default, opt-in admin configuration - without this setting the vulnerable shortcode is inactive; (3) a victim user must visit a page or post containing the injected shortcode payload, which occurs through normal site browsing rather than requiring the attacker to send a crafted link. The combination of required contributor authentication and the admin-controlled prerequisite significantly narrows the exploitable population compared to the raw CVSS score suggests.

The CVSS 6.4 score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N characterizes this as a network-accessible, low-complexity stored XSS requiring only contributor-level authentication. However, a critical exploitation prerequisite caps practical risk: the administrator must explicitly enable the wppb_toolbox_shortcodes_settings[format-date] option for the shortcode to be active. This non-default configuration requirement is not reflected in the AC:L rating from Wordfence, and independent scoring places this at AC:H. Without EPSS data provided, exploitation probability cannot be quantified, but no KEV listing or public POC exists. Real-world priority is moderate: sites with contributor-role users who write content AND with the format-date shortcode setting enabled by an admin face meaningful risk of session hijacking or credential phishing; all others have a negligible attack surface. CVSS vector somewhat overstates exploitability by not accounting for the admin-controlled prerequisite.

An attacker with a WordPress contributor account on a site where an administrator has enabled the format-date shortcode setting crafts a post or page embedding a malicious 'date' shortcode attribute containing a JavaScript payload. When any authenticated user - including site administrators - later views that page, the script executes in their browser, potentially harvesting session cookies, WordPress nonces, or redirecting the victim to a credential-phishing page. No public POC has been identified at time of analysis.