Profile Builder CVE-2026-96338

Requires an authenticated Subscriber-level account (PR:L); on Profile Builder deployments front-end self-registration is commonly enabled, lowering the barrier to obtaining such an account. Exploitation also requires victim user interaction (UI:R) - a privileged or other user must view the page rendering the attacker's injected payload - which limits reliability and makes it interaction-dependent rather than fully automatable. Affected on Profile Builder versions <= 4.0.2; sites where anonymous registration is disabled or Subscriber accounts are tightly restricted materially reduce exposure.

This is a moderate, not urgent, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) describes an authenticated Subscriber-level (PR:L) cross-site scripting flaw requiring victim interaction (UI:R) with a scope change (S:C) and only Low impact across confidentiality, integrity, and availability. No EPSS score, KEV listing, SSVC decision data, or public POC was supplied, so all three exploitation signals point to no evidence of active or automated exploitation at time of analysis. The realistic threat is a low-privileged registered user (Profile Builder specifically enables front-end user registration, so obtaining a Subscriber account is often trivially self-service) injecting a script payload that executes in another user's or an administrator's browser context - the S:C rating reflects escalation potential into the admin origin. The signals are internally consistent: an authenticated, interaction-dependent XSS with limited per-incident impact is a genuine but bounded issue rather than a mass-exploitation candidate. Missing EPSS/KEV/POC data should be treated as 'not yet observed' rather than 'safe.'

An attacker self-registers a Subscriber account on a site running Profile Builder (whose front-end registration this plugin provides), then submits a profile field containing a stored XSS payload. When an administrator or another user views the attacker's profile or the relevant admin listing, the script executes in their authenticated browser session, potentially enabling session or action abuse across the site origin. No public exploit code was identified in the provided data.