CVE-2026-76546 in User Profile Builder Plugin
Summary
by MITRE • 08/29/2026
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2026
The User Profile Builder plugin for WordPress contains a critical security vulnerability in versions prior to 4.0.1 that stems from insufficient input validation and output encoding mechanisms within its optional shortcodes functionality. This flaw specifically affects the handling of user-generated content processed through these shortcodes, where data is rendered directly into the HTML context without proper sanitization or escaping. The absence of adequate security controls allows malicious actors to inject executable script code into stored content, which persists on the server and is subsequently served to other users upon request. This architectural weakness represents a classic instance of Stored Cross-Site Scripting, also known as Persistent XSS, where the payload remains active in the database until explicitly removed by an administrator or through automated cleanup processes.
The severity of this vulnerability is significantly amplified by its low privilege requirement for exploitation. Users with even minimal access levels, such as those assigned the contributor role, possess sufficient permissions to create and publish content that includes malicious payloads via the affected shortcode. This means that any user who can write posts or profiles on a WordPress site hosting an unpatched version of the plugin can execute arbitrary JavaScript in the context of other users' browsers. The impact extends beyond typical session hijacking scenarios; attackers can manipulate page DOM elements, steal sensitive data such as authentication cookies and tokens, perform actions on behalf of victims including administrative tasks if those victims are logged in with higher privileges, or redirect users to phishing sites designed to capture credentials.
From a threat modeling perspective, this vulnerability aligns closely with CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of the attack falls under MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of web browsers executing JavaScript payloads. Because the payload is stored server-side rather than being delivered via a link or external vector, it bypasses many client-side security filters that might otherwise mitigate reflected XSS attacks. The fact that the vulnerable shortcode is not enabled by default provides some inherent mitigation for sites that do not actively utilize this specific feature, but any site administrator who enables optional functionality without reviewing its security implications exposes their entire user base to risk.
The operational impact of this vulnerability includes potential compromise of administrative accounts through session theft or credential harvesting, leading to full control over the WordPress installation and associated data stores. Attackers can use the compromised browser context to exfiltrate sensitive information such as personal identifiable information stored in user profiles, database credentials if accessible via client-side scripts, or internal network configurations exposed through DOM manipulation. Furthermore, the persistence of the malicious code means that every visitor viewing the infected content becomes a potential victim, creating a widespread and continuous threat vector until the vulnerability is patched or the compromised content is manually removed from the system.
To mitigate this risk, organizations running WordPress sites with the User Profile Builder plugin must immediately upgrade to version 4.0.1 or later where these output escaping mechanisms have been properly implemented. Administrators should also audit existing content for any injected scripts if an immediate update is not feasible, although patching remains the primary and most effective remediation strategy. Additionally, implementing a Content Security Policy header can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of stored payloads even in environments where updates might be delayed due to compatibility concerns with other plugins or themes.