Profile Builder EUVD-2026-102682

Exploitation requires the 'Email Confirmation' feature to be enabled in Profile Builder - this is the explicit, named prerequisite from the description and is the primary limiting factor, since sites using default/non-email-confirmation registration flows are not reachable through this path. Given that gate, an unauthenticated remote attacker can inject a stored payload via the First Name field during registration (no authentication or user interaction needed to plant it, consistent with PR:N/UI:N). Execution occurs when a user accesses the injected page (realistically an administrator processing registrations), so impact depends on a privileged user viewing the stored content. Affected versions are all releases up to and including 4.0.3; upgrading past the version fixed in changeset 3741133 removes exposure.

This is a stored XSS (CWE-79) in the widely-used WordPress Profile Builder plugin, rated CVSS 7.2 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, low-complexity, and unauthenticated (PR:N), with a scope change (S:C) reflecting that injected script executes in a victim's browser context rather than the vulnerable component. The low-but-real confidentiality and integrity impact (C:L/I:L) is typical of XSS: session/cookie theft and limited content manipulation rather than full server compromise. No EPSS score, CISA KEV entry, or public exploit was provided in the input, so per the exploitation-status rules this is 'no public exploit identified at time of analysis.' The single most important mitigating signal - not reflected in the raw 7.2 score - is that exploitation is gated on a non-default plugin setting: the vulnerability is only reachable when the Email Confirmation feature is enabled in Profile Builder. This materially narrows the real-world exposed population below what AV:N/PR:N alone would imply. Net: a credible, vendor-confirmed (Wordfence) vulnerability worth patching promptly on sites that enable Email Confirmation, but not an emergency-grade mass-exploitation threat given no exploitation evidence and the required non-default configuration.

On a WordPress site running Profile Builder (≤4.0.3) with the Email Confirmation feature enabled, an unauthenticated attacker submits a registration containing a malicious payload in the First Name field, which is stored without sufficient sanitization or output escaping. When a user - typically an administrator reviewing the email-confirmation/registration page - opens the affected page, the script executes in their browser, enabling session hijacking or admin-context actions. No public proof-of-concept was identified in the provided data, but the vendor (Wordfence) has confirmed the flaw and a fix (changeset 3741133).