CVE-2026-75965 in User Profile Builder Plugin
Summary
by MITRE • 09/01/2026
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The User Profile Builder plugin, widely utilized in WordPress environments to manage user registration forms, profiles, and role editing capabilities, contains a significant security flaw identified as Stored Cross-Site Scripting within its date short code attribute functionality. This vulnerability affects all versions up through 4.0.0 and stems from insufficient input sanitization and output escaping mechanisms when processing specific configuration parameters. The core technical issue lies in the handling of the format-date option, which allows administrators to define how dates are displayed via short codes. When this feature is enabled by an administrator with appropriate privileges, the system fails to properly validate or escape user-supplied data before rendering it on public-facing pages. This lack of rigorous validation creates a pathway for malicious actors to inject executable JavaScript code into the application's output stream.
The operational impact of this vulnerability is severe due to its stored nature and the relatively low privilege threshold required for exploitation. An attacker with contributor-level access or higher can exploit this flaw by injecting arbitrary web scripts through the vulnerable short code attribute. Unlike reflected cross-site scripting, where malicious payloads are delivered via links, a stored XSS attack persists on the server side. Once injected, the malicious script is saved within the database and executed automatically whenever any user accesses the affected page. This persistence ensures that every visitor to the compromised site becomes a potential victim of the attack without needing to interact with a specific link or trigger an event manually. The requirement for contributor-level access makes this vulnerability particularly dangerous in multi-author sites, as such accounts are common and often granted more trust than anonymous users but less oversight than administrators.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the failure to sanitize user input before storage (CWE-20) and the subsequent failure to escape output when rendering that data in a web browser context (CWE-116). In terms of tactical behavior, this attack vector corresponds to ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution. The attacker leverages the application's own functionality against its users, turning legitimate features into vectors for compromise. This type of attack is often used as a precursor to more severe breaches, such as session hijacking, credential theft via keyloggers embedded in the injected script, or defacement of the website content.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The most effective solution is to upgrade the User Profile Builder plugin to version 4.0.1 or later, where this input validation issue has been resolved by developers implementing stricter sanitization routines. For organizations unable to patch immediately due to compatibility concerns with other plugins, a temporary workaround involves disabling the date short code feature entirely if it is not strictly necessary for business operations. This can be achieved by setting the wppb_toolbox_shortcodes_settings[format-date] option to no via database manipulation or plugin settings, thereby neutralizing the attack vector until an upgrade is feasible. Additionally, implementing a Web Application Firewall with rulesets tuned to detect and block XSS payloads in short code attributes can provide an additional layer of defense. Regular security audits focusing on input validation across all user-facing forms are also recommended to prevent similar vulnerabilities from arising in other parts of the application ecosystem.