CVE-2026-111966 in User Profile Builder Plugin
Summary
by MITRE • 10/23/2026
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The User Profile Builder plugin for WordPress is a widely utilized tool that enables site administrators to create custom user registration and profile management forms through shortcodes. A critical security flaw exists in versions prior to 4.0.5, specifically within the handling of shortcode attributes used to define form behavior or display messages. The vulnerability stems from an insufficient sanitization and escaping mechanism when processing specific input fields associated with these shortcodes. When a user submits data via one of these forms, the plugin processes the input but fails to properly validate or encode it before storing it in the database for later retrieval during redirect operations. This lack of rigorous input validation creates a pathway for malicious actors to inject executable script code into what is intended to be benign form data.
The technical nature of this flaw classifies as an Improper Input Validation vulnerability, aligning with CWE-20 standards regarding inadequate checking of user-supplied information before it enters the application logic. More critically, because the unsanitized input is stored in the database and subsequently rendered back to users during a redirect message display, the issue manifests as Stored Cross-Site Scripting, corresponding to CWE-79. This distinction is vital because unlike reflected XSS where malicious links must be clicked by victims, this vulnerability allows an attacker to persistently store their payload on the target server. The code executes automatically whenever any user views the affected page or form submission result, significantly increasing the attack surface and potential impact without requiring complex social engineering tactics beyond initial access to submit a form.
The operational impact of this vulnerability is severe due to its low privilege requirement for exploitation. Users with as little as contributor-level access can exploit this flaw by crafting specific input values containing malicious JavaScript payloads within the affected shortcode attributes or associated form fields. Once submitted, these scripts are saved and later executed in the context of higher-privileged users who visit the page displaying the redirect message. This allows attackers to perform actions such as stealing session cookies, hijacking administrative sessions, performing unauthorized account modifications, or defacing websites. The ability for lower-level users to impact high-privilege accounts represents a significant escalation of privilege risk and undermines the integrity of role-based access controls inherent in WordPress installations.
From an offensive security perspective, this vulnerability maps directly to the MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. The attack chain involves initial reconnaissance or direct submission by a low-privileged user, followed by persistence through storage of the malicious payload in the database, and finally execution when an administrator interacts with the compromised page. This behavior facilitates credential theft and session hijacking, which are foundational steps for deeper system compromise. Organizations relying on this plugin must recognize that even minor version updates can introduce or resolve such critical logic errors related to data handling and output encoding.
To mitigate this vulnerability, immediate action is required by upgrading the User Profile Builder plugin to version 4.0.5 or later, where these sanitization issues have been addressed. Administrators should ensure that all plugins are kept up-to-date with their latest stable releases to benefit from security patches addressing input validation and output encoding flaws. Additionally, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious script injections before they reach the application logic or database. For environments where immediate patching is not feasible due to compatibility concerns, temporary workarounds might include restricting form submission capabilities to higher-privileged users only until the update can be applied, thereby reducing the pool of potential attackers who can inject payloads into the system.