Description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-07T13:20:36.653Z",
  "pubdate": "2026-09-07T13:20:36.653Z",
  "executiveSummary": "The User Profile Builder plugin for WordPress, in versions up to and including 3.15.7, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from improper input sanitization and output escaping within the 'Biographical Info' user meta field.\nThe flaw allows unauthenticated attackers to inject malicious JavaScript payloads that are persisted in the application database.\nUpon a user visiting a page where the injected biographical information is rendered, the malicious script executes within the context of the victim's browser session.\nSuccessful exploitation poses significant security risks, including unauthorized access to session tokens, data exfiltration, and the ability for attackers to perform administrative actions on behalf of the victim.\nAs the vulnerability permits unauthenticated exploitation, it represents a high-risk security flaw for affected WordPress deployments.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the User Profile Builder plugin to enforce adequate server-side input sanitization and context-aware output encoding on user-supplied data submitted via the 'Biographical Info' meta field.\nBecause the input is stored directly into the database without removing or neutralizing executable HTML/JavaScript tags, and subsequently rendered into the DOM without appropriate escaping, the application becomes an inadvertent vector for script injection.\nThe attack flow begins with an unauthenticated threat actor targeting the registration or profile update endpoints associated with the plugin. The attacker submits a crafted payload containing script tags—such as <script>alert(document.cookie)</script>—or event-based handlers—such as <img src=x onerror=payload()>—into the 'Biographical Info' input field.\nThe application accepts this payload and commits it to the WordPress database. When an administrative user or a privileged account views the affected profile, the plugin retrieves the malicious entry from the database and renders it in the web interface. Because the data is rendered without escaping, the browser interprets the injected payload as legitimate application code.\nThe execution occurs within the security context of the victim's session, granting the malicious script full access to the Document Object Model (DOM), browser storage (including LocalStorage and SessionStorage), and the ability to capture session cookies via document.cookie. Furthermore, the attacker can leverage this execution to make background requests to the WordPress API or administrative dashboard, enabling actions such as privilege escalation, creating new rogue administrative accounts, or modifying site configuration settings.\nThe vulnerability is pervasive across all versions up to 3.15.7 and requires no authentication, meaning an attacker can trigger this vulnerability during the account registration process or via publicly accessible profile modification forms, depending on the plugin's configuration. The persistent nature of Stored XSS ensures the payload triggers every time the compromised profile data is viewed, maximizing the exposure window."
}