Description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T08:16:42.307Z",
  "pubdate": "2026-09-25T08:16:42.307Z",
  "executiveSummary": "The User Profile Builder plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing in its avatar management functionality.\nThe flaw stems from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious JavaScript payloads into user profile meta data.\nWhen an administrator views an affected user profile, the stored malicious script executes within the context of their session. This compromise can lead to unauthorized administrative actions, session hijacking, or exfiltration of sensitive site data.\nThe vulnerability affects all versions of the User Profile Builder plugin up to and including 4.0.2.\nExploitation is feasible for unauthenticated remote attackers because the avatar upload process fails to properly validate incoming multipart data, permitting the bypass of established security checks. The primary risk is high due to the potential for cross-site request forgery and full administrative account compromise through script execution in privileged user dashboards.",
  "technicalDetails": "The root cause of this vulnerability is an improper handling of input within the wppb_save_avatar_value() function. During the avatar upload process, the plugin contains a zero-length multipart file branch that processes the request incorrectly.\nSpecifically, when an attacker submits a specially crafted request, the application bypasses the standard wppb_save_attachment_id() and wppb_verify_attachment_id() validation routines, which are intended to ensure that submitted files meet strict security and file-type requirements.\nBy bypassing these functions, the plugin writes the raw, unvalidated input directly to the WordPress user meta database. This mechanism allows for the injection of arbitrary HTML and JavaScript tags into the stored avatar field value.\nThe exploitation flow proceeds as follows: An unauthenticated attacker sends a crafted multipart request to the avatar upload endpoint. Because the server-side logic fails to sanitize the payload before database insertion, the malicious script is persisted as user meta data associated with the account.\nThe payload remains dormant until the application attempts to render the profile information. The function wppb_default_fields_make_upload_button() is responsible for retrieving the stored avatar data and rendering it for the administrator. Because this function fails to apply appropriate output escaping before printing the data to the HTML document, the injected script is executed by the browser.\nThe impact is elevated because the script executes in the context of an administrator’s browser session. If an administrator visits the compromised user profile, the malicious JavaScript can execute arbitrary actions, such as changing site settings, creating new administrative accounts, or stealing authentication cookies.\nThis vulnerability highlights a critical failure in the plugin’s development lifecycle regarding the 'Trust No Input' principle and a failure to enforce context-aware output encoding. The lack of validation on the avatar field entry point effectively permits arbitrary client-side code injection, providing a high-impact vector for remote attackers to gain unauthorized control over the WordPress installation via administrative session manipulation."
}