EUVD-2026-68050
GHSA-ff29-gmhf-78ff
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor is low privilege (PR:L, not PR:H as stated); stored XSS crosses into victim browser scope (S:C); no availability impact from XSS itself.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.
AnalysisAI
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following simultaneously: (1) the specific optional User Profile Builder shortcode must be explicitly enabled on the target site - it is NOT active by default, so a large fraction of User Profile Builder deployments are not exposed; (2) the attacker must hold a contributor-level (or higher) WordPress account on that specific site; and (3) a victim user must navigate to and view the page or post containing the injected shortcode. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The stated CVSS score of 6.8 is derived from a PR:H vector, which directly conflicts with the CVE description's explicit claim that exploitation is possible for users 'as low as contributor' - a low-privilege WordPress role well below administrator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the User Profile Builder WordPress plugin to version 4.0.1 or later, which is the vendor-released patch per the WPScan advisory at https://wpscan.com/vulnerability/2c67d682-3e11-4fcd-9aae-ab7895d5da67/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Profile Builder
View allUnauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allo
Session hijacking in the User Profile Builder WordPress plugin (versions before 3.16.4) allows unauthenticated attackers
PHP Object Injection in User Profile Builder WordPress plugin (versions 3.3.4 through before 4.0.1) allows authenticated
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today