Description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manage_options capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by row_actions().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-01T06:16:37.697Z",
  "pubdate": "2026-09-01T06:16:37.697Z",
  "executiveSummary": "The User Profile Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to inadequate input sanitization and output escaping within the 'email' parameter.\nThe vulnerability affects all versions up to and including 4.0.0. An unauthenticated attacker can inject arbitrary malicious JavaScript into user-related fields.\nThis payload remains dormant until it reaches an administrator with the 'manage_options' capability. When the administrator accesses the 'Users > Unconfirmed Email Addresses' management page, the injected script executes within their session context.\nSuccessful exploitation allows attackers to perform actions on behalf of the administrator, potentially leading to unauthorized site configuration changes, account takeovers, or the exfiltration of sensitive administrative session tokens.\nBecause the attack vector targets an administrative interface, the risk profile is elevated, necessitating immediate attention to input validation and output encoding protocols.",
  "technicalDetails": "The vulnerability resides in the inadequate processing of the 'email' parameter during the user registration or profile update process. The plugin fails to perform rigorous server-side input sanitization, allowing the inclusion of malicious scripts or URI-based payloads (e.g., 'javascript:' pseudo-protocols).\nThe core issue is exacerbated by the improper output encoding performed by the 'row_actions()' function. When an administrator navigates to the 'Users > Unconfirmed Email Addresses' list table, the plugin renders the stored, tainted email data directly into the HTML structure of the administrative panel.\nBecause the application injects this data into an 'href' attribute without verifying the protocol or escaping the content, the browser interprets the 'javascript:' prefix as executable code rather than a standard hyperlink destination.\nThe attack flow follows a specific progression: First, an unauthenticated attacker submits a registration request using a malicious payload crafted as an email address. This input is saved to the database without being neutralized. Second, the payload remains stored until an administrator views the 'Unconfirmed Email Addresses' page.\nWhen the administrative user interacts with the affected row-action links, the injected JavaScript executes within the security context of the administrator's session. This grants the attacker full access to the Document Object Model (DOM) of the page, enabling the execution of arbitrary API requests, the theft of session cookies (if 'HttpOnly' flags are absent), or the redirection of the administrative user to malicious third-party domains.\nThis vulnerability highlights a critical failure in the application's defense-in-depth strategy: the lack of context-aware output encoding. By failing to sanitize user-controllable input before rendering it in a security-sensitive administrative UI component, the plugin creates a persistent vector for Cross-Site Scripting that bypasses traditional client-side protections."
}