Profile Builder EUVD-2026-102661

Requires an authenticated WordPress account at subscriber level or above on a site running User Profile Builder <=4.0.3, meaning the site must permit open/self-service registration or the attacker must already hold a low-privilege account. The attacker sets a script payload in the 'display_name' field and posts a comment; because the unsanitized value is stored in wp_comments.comment_author, the payload persists and fires whenever any user renders the affected page - independent of later deletion or renaming of the attacker's account. Limiting factors: exploitation needs valid authentication (not fully anonymous), and sites that disable public registration or restrict subscriber accounts substantially reduce exposure; impact is confined to script execution in viewers' browsers (session/CSRF-token theft, UI manipulation) rather than direct server compromise.

This is a genuine but mid-tier risk rather than an emergency. The CVSS 3.1 base score is 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - network-reachable, low complexity, but requiring authentication (PR:L, subscriber-level) and yielding only low confidentiality/integrity impact with a scope change (stored script executing in other users' browser context). No EPSS score, CISA KEV listing, or public POC is present in the provided data, so by the input signals exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The main signals are internally consistent: the authenticated-low-privilege requirement in the CVSS vector matches the description's 'subscriber-level access and above,' so there is no AV:N-vs-local contradiction to flag. The notable aggravating detail beyond raw CVSS is persistence semantics - the payload lives in wp_comments.comment_author independently of the attacker's account, so defenders cannot neutralize it merely by banning the user or resetting the display name; the comment row must be purged. Bottom line: a credible stored-XSS priority for sites that allow open or low-trust registration, but not a drop-everything issue absent evidence of active exploitation.

On a WordPress site running User Profile Builder <=4.0.3 with open registration, an attacker registers a subscriber account and sets a malicious script as their display_name, then posts a comment so the payload is stored in wp_comments.comment_author. When any visitor or administrator later views the page containing that comment, the script executes in their browser session. No public exploit code is identified in the provided data, and exploitation requires an authenticated low-privilege account.