Description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user's Edit User screen.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-25T08:16:41.570Z",
  "pubdate": "2026-09-25T08:16:41.570Z",
  "executiveSummary": "The User Profile Builder plugin for WordPress, in all versions up to and including 4.0.2, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the Avatar Field functionality.\nThis security flaw allows authenticated users, specifically those with Subscriber-level privileges or higher, to inject arbitrary JavaScript payloads into the application.\nThe vulnerability is primarily caused by insufficient input sanitization and a lack of proper output escaping on user-provided profile data.\nSuccessful exploitation facilitates the execution of malicious scripts within the context of an administrator’s browser session when they access the affected user's profile.\nThis poses a significant risk as it can lead to full administrative account takeover, unauthorized administrative actions, or session hijacking, given that the payload executes within the privileged /wp-admin/ context.\nThe exploitation process is streamlined as it does not require a nonce-protected form submission, allowing for malicious payloads to be injected via a simple GET request to /wp-admin/profile.php.\nOrganizations utilizing this plugin are encouraged to restrict user access where possible and monitor for updates that provide necessary sanitization routines.",
  "technicalDetails": "The vulnerability manifests as a Stored XSS condition originating from the insecure handling of the Avatar Field input within the User Profile Builder plugin. The root cause is the failure to properly sanitize user-supplied input before storage and the subsequent failure to escape this data upon rendering in the WordPress administrative interface.\nIn WordPress, profile management often involves the update_user_meta function, which acts as the data persistence layer. The plugin fails to apply adequate filters to the avatar-related metadata, allowing for the injection of non-compliant data, such as JavaScript-laden strings, into the database.\nThe attack vector is particularly concerning due to its minimal requirements. An attacker with standard Subscriber-level access can initiate the exploitation without needing to bypass nonces, as the vulnerable endpoint at /wp-admin/profile.php does not sufficiently validate the integrity of the request for this specific field. By crafting a malicious GET request that modifies the avatar URL or metadata property, an attacker can store their payload directly into the target user's profile metadata.\nThe attack flow follows a structured path: first, the authenticated attacker crafts a request targeting the user profile update mechanism. Second, the server-side logic of the plugin accepts this payload, failing to strip malicious tags or sanitize the attribute values. Third, the payload is persisted in the database associated with the attacker's account. Finally, when an administrator navigates to the 'Edit User' screen to review the subscriber's details, the application retrieves the malicious metadata and renders it unsanitized within the DOM of the administrator's browser.\nOnce the payload executes in the administrator's context, it gains access to the administrator's session cookies, local storage, and the Document Object Model (DOM) of the /wp-admin/ dashboard. This level of execution permits the attacker to perform arbitrary administrative tasks, such as creating new administrative users, modifying plugin settings, or exfiltrating sensitive data, effectively bypassing the security boundary intended for the Subscriber role.\nThe vulnerability is present in versions up to and including 4.0.2, affecting all environments where the plugin is active and registered users have profile access. Because the payload is stored persistently in the database, the malicious script will trigger every time the affected user profile is loaded by a user with higher privileges, ensuring a high probability of successful exploitation if the administrator manages active subscriber accounts."
}