Stored XSS in User Profile Builder WordPress Plugin

Executive Summary

CVE-2026-76546 is a stored Cross-Site Scripting (XSS) vulnerability in the Profile Builder WordPress plugin versions before 4.0.1. It occurs because the plugin does not escape output from one of its optional shortcodes, allowing users with contributor-level access or higher to inject malicious scripts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Profile Builder WordPress plugin is installed and if its version is prior to 4.0.1. Inspect the plugin's shortcode usage for unescaped output. Review user roles with contributor access or higher for suspicious script injections in posts or pages.

Useful 0 Not Useful 0

Impact Analysis

Attackers with contributor access or higher can inject malicious scripts into web pages. When other users, including administrators, view the affected content, the scripts execute, potentially stealing sensitive data, session cookies, or performing unauthorized actions on their behalf.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, compromising personal or sensitive information. For GDPR, it may result in unauthorized access to user data, triggering reporting requirements. For HIPAA, it could expose protected health information, violating compliance standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Profile Builder plugin to version 4.0.1 or later. Disable the affected shortcode if not in use. Audit user roles to ensure no unauthorized contributors have access. Monitor content for injected scripts and remove any detected malicious code.

Useful 0 Not Useful 0