EUVD-2026-86598
GHSA-8232-rvww-wm4x
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable stored XSS (PR:N/AV:N/AC:L) crossing into an admin browser session (S:C) yields limited C:L/I:L, no availability impact; UI:N follows Wordfence convention for passive admin-view triggering.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder) through version 4.0.2 allows unauthenticated attackers to write raw, unsanitized input into a user's avatar meta by submitting a zero-length multipart file to any public registration or edit-profile form that exposes the Avatar field; the payload then lies dormant until a victim - typically an administrator - views the affected account, at which point it is rendered unescaped as an attachment URL. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), indicating remote and unauthenticated injection with low confidentiality and integrity impact and a scope change because the script executes within the WordPress administrative context; the practical trigger still depends on a privileged user subsequently loading the injected profile. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a User Profile Builder front-end form (registration or edit-profile) that exposes the Avatar field, so the plugin must be installed (<=4.0.2) and the avatar field configured on a public form. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status: Upstream fix available (PR/commit); released patched version not independently confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all WordPress installations for User Profile Builder (Profile Builder) versions through 4.0.2, deactivate or remove the plugin if it is not business-critical, and restrict or disable public registration and edit-profile forms that expose the Avatar field. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in User Profile Builder Beautiful User Registration Forms User Profiles User Role Editor
View allStored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthen
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows aut
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder by Cozmoslabs) through version
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to
User Profile Builder plugin for WordPress up to version 3.15.5 allows authenticated subscribers and above to reassign ow
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today