Description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T05:17:10.023Z",
  "pubdate": "2026-09-01T05:17:10.023Z",
  "executiveSummary": "The User Profile Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 4.0.0.\nThe flaw originates from improper input sanitization and output escaping within the 'date' shortcode attribute.\nSuccessful exploitation allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript into WordPress pages.\nWhen a victim, including high-privileged administrators, views an affected page, the malicious script executes within the context of their session.\nThe vulnerability requires that an administrator has explicitly enabled the 'format-date' option within the 'wppb_toolbox_shortcodes_settings' configuration for the specific shortcode to be active.\nThis vulnerability poses a significant risk, potentially leading to unauthorized administrative actions, session hijacking, or the defacement of site content.\nGiven the nature of Stored XSS, the payload persists on the server and executes across multiple user sessions, increasing the overall threat posture.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the User Profile Builder plugin to adequately sanitize user-supplied input or encode output before rendering it within the 'date' attribute of its proprietary shortcodes.\nWhen the 'wppb_toolbox_shortcodes_settings[format-date]' configuration option is set to 'yes', the plugin processes shortcode attributes in a manner that renders them vulnerable to script injection.\nAn authenticated user with contributor-level privileges can craft a malicious shortcode payload containing embedded JavaScript. Because the plugin does not properly validate this input, the payload is stored directly in the database.\nThe attack flow proceeds as follows: First, the attacker identifies a page or post where they have the capability to insert shortcodes. Second, they inject a 'date' shortcode with a malicious string designed to break out of the HTML attribute context. Third, upon rendering the page, the application echoes the unsanitized input into the Document Object Model (DOM).\nOnce the malicious payload is stored, any user who visits the affected page triggers the execution of the injected script within their browser. The script runs with the permissions of the viewing user, which, in the case of a WordPress administrator, grants the attacker the ability to perform actions such as creating new administrative accounts, modifying site settings, or redirecting traffic to malicious domains.\nThis vulnerability is classified as Stored XSS because the malicious script is persisted on the server, ensuring execution whenever the page is rendered for any user. The necessity for the 'format-date' setting to be enabled acts as a configuration-based gating mechanism, yet once active, the attack vector is fully exploitable by any authenticated contributor. The lack of output escaping ensures that the browser interprets the injected data as executable code rather than plain text, bypassing standard browser-level XSS filters in many scenarios."
}