Description

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-29T06:17:24.977Z",
  "pubdate": "2026-08-29T06:17:24.977Z",
  "executiveSummary": "The User Profile Builder plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper output sanitization of an optional shortcode.\nThis vulnerability allows authenticated attackers with 'contributor' privileges or higher to inject malicious JavaScript into WordPress content.\nThe impact is significant, as the injected scripts execute within the context of the victim's session when they view the compromised page.\nIf an administrator views the affected content, the attacker may perform unauthorized administrative actions, steal sensitive session data, or achieve full site compromise.\nWhile the shortcode is not enabled by default, environments that have manually activated this feature are susceptible to exploitation.\nThe vulnerability affects all versions of the User Profile Builder plugin prior to 4.0.1.\nSuccessful exploitation requires the attacker to have at least contributor-level access to the WordPress instance.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the User Profile Builder plugin to properly encode or sanitize user-supplied data before rendering it via an optional shortcode.\nIn WordPress development, outputting data directly from shortcode attributes or user-provided parameters without applying appropriate escaping functions (e.g., esc_html(), esc_attr(), or wp_kses()) creates an injection vector for malicious scripts.\nThe vulnerability allows an authenticated attacker to provide a malicious payload within the parameters of the vulnerable shortcode. When this shortcode is embedded in a page, post, or widget, the payload is stored in the WordPress database.\nThe attack flow begins when an attacker with contributor permissions creates or edits content containing the vulnerable shortcode, injecting a crafted XSS payload into an attribute.\nWhen a legitimate user—most notably an administrator—loads the page where the shortcode is executed, the server renders the stored malicious payload directly into the HTML document's Document Object Model (DOM).\nBecause the payload is reflected without proper sanitization, the browser executes the JavaScript under the security context of the target user's session.\nThis can lead to full account takeover through session token theft, unauthorized administrative actions such as creating new rogue accounts, or redirecting users to malicious external domains.\nThe vulnerability is restricted to environments where the specific optional shortcode has been explicitly enabled by a site administrator, as it does not function by default.\nThe flaw affects all versions of User Profile Builder prior to 4.0.1. The lack of output encoding ensures that any JavaScript placed within the shortcode's parameters will be executed by the client-side browser of any user viewing the page.\nSince the script executes in the victim's browser, the attacker can leverage the victim's authenticated privileges to bypass CSRF protections and interact with the WordPress REST API or admin-ajax.php to perform unauthorized configuration changes."
}