User Profile Builder EUVD-2026-107075

Exploitation requires that a high-privilege user (e.g., administrator) be logged into WordPress and be induced to click an attacker-supplied URL that loads the specific vulnerable plugin admin page, where the current page URL is reflected unescaped into a JavaScript context. Limiting factors: the payload only executes against users who already have access to that admin page (high-privilege targets), and mandatory user interaction (UI:R) means there is no automatic or unattended exploitation - the attack fails without a victim clicking the crafted link. The attacker needs no WordPress credentials themselves (PR:N), but the plugin must be installed and at a version before 4.0.1.

This is a moderate-severity, context-dependent issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) indicates a network-reachable flaw requiring no attacker authentication but mandating victim interaction (UI:R) - the target must click an attacker-crafted URL. Critically, the description specifies the XSS fires on an admin page and is effective 'against high-privilege users,' so successful exploitation requires socially engineering a logged-in administrator, which meaningfully narrows the realistic attack surface despite the PR:N rating. Exploitation signals are mixed: publicly available exploit code exists (POC=YES via WPScan), which raises accessibility, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation - treat the POC and active-exploitation as distinct, and do not assume in-the-wild use. No SSVC decision data was supplied. Net assessment: a real but second-tier priority - patch promptly because a vendor fix and public POC exist, but the dependence on tricking a high-privilege user to click a malicious link makes mass, automated exploitation unlikely compared to an unauthenticated, no-interaction RCE.

An attacker crafts a malicious URL pointing at the vulnerable plugin admin page with a payload embedded in the page URL, then phishes a WordPress administrator into clicking it. Because the current page URL is output unescaped in a JavaScript context, the script executes in the admin's authenticated browser session, allowing actions such as creating rogue admin accounts or injecting backdoors. Public exploit code is available (WPScan), lowering the skill required, though success still depends on the admin interacting with the link.