User Profile Builder EUVD-2026-108594

The attacker needs an authenticated account; the description states a role 'as low as contributor' suffices, which is lower than the supplied vector's PR:H. The site must use the affected User Profile Builder shortcode/form. Exploitation additionally requires a higher-privileged user to submit the affected form (UI:R) so the unescaped shortcode attribute is rendered back in the redirect message - the payload does not fire on its own. Fixed in User Profile Builder 4.0.5; no mitigation other than updating is stated in the available sources. These limiting factors (prior authenticated access plus required victim interaction) meaningfully reduce real-world exploitability despite the network attack vector.

Signals are consistent and point to a real-but-not-urgent issue. The vendor CVSS (6.8, AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) and SSVC (Exploitation: none, Automatable: no, Technical Impact: total) agree that this requires an authenticated foothold plus victim interaction and is not mass-exploitable; the vuln.today priority is 'this_month', not act_now/emergency. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. CONFLICT TO VERIFY: the supplied CVSS vector sets PR:H (high privileges), but the description explicitly says the attack is available to 'users with a role as low as contributor' (a low-privilege role) - WPScan normally rates contributor as PR:L, so the real privilege bar is likely lower than PR:H implies; verify with the WPScan advisory. The C:H/I:H/A:H impact rating also looks aggressive for a stored XSS and appears to assume full account takeover of the victim.

A contributor-level user on a multi-author WordPress site embeds a malicious payload in the vulnerable User Profile Builder shortcode attribute, which is reflected unescaped into the form's redirect message. When a higher-privileged user (e.g., an administrator) submits the affected form, the stored script executes in their browser session, potentially enabling account or session compromise. No public exploit was identified at time of analysis, though a WPScan advisory reference exists.