CVE-2026-111948

Deferred Deferred - Pending Action

Reflected Cross-Site Scripting in User Profile Builder WordPress Plugin

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-111948

EUVD

EUVD-2026-107075

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	User Profile Builder	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

The User Profile Builder WordPress plugin before version 4.0.1 has a reflected Cross-Site Scripting (XSS) vulnerability. It fails to properly escape the current page URL before outputting it in a JavaScript context on an admin page. This allows attackers to inject malicious scripts that execute when high-privilege users access the affected page.

Detection Guidance

Check if the User Profile Builder WordPress plugin version is below 4.0.1. Inspect admin pages for improperly escaped URLs in JavaScript contexts. Monitor for unusual script execution in high-privilege user sessions.

Impact Analysis

An attacker could exploit this to run malicious scripts in the browser of high-privilege users like administrators. This could lead to session hijacking, unauthorized actions, or theft of sensitive data such as login credentials or personal information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Non-compliance may result in legal penalties, fines, or reputational damage for organizations handling sensitive user data.

Mitigation Strategies

Update the User Profile Builder plugin to version 4.0.1 or later immediately. Remove or disable the plugin if updates are not possible. Restrict access to admin pages until the update is applied.

Hi! I’m here to help you understand CVE-2026-111948. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...