CVE-2026-76546

Deferred Deferred - Pending Action

Stored XSS in User Profile Builder WordPress Plugin

Publication date: 2026-08-29

Last updated on: 2026-08-30

Assigner: WPScan

Description

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-29

Last Modified

2026-08-30

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-76546

EUVD

EUVD-2026-68050

Affected Vendors & Products

Vendor	Product	Version / Range
wpengine	profile_builder	to 4.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-76546 is a stored Cross-Site Scripting (XSS) vulnerability in the Profile Builder WordPress plugin versions before 4.0.1. It occurs because the plugin does not escape output from one of its optional shortcodes, allowing users with contributor-level access or higher to inject malicious scripts.

Detection Guidance

To detect this vulnerability, check if the Profile Builder WordPress plugin is installed and if its version is prior to 4.0.1. Inspect the plugin's shortcode usage for unescaped output. Review user roles with contributor access or higher for suspicious script injections in posts or pages.

Impact Analysis

Attackers with contributor access or higher can inject malicious scripts into web pages. When other users, including administrators, view the affected content, the scripts execute, potentially stealing sensitive data, session cookies, or performing unauthorized actions on their behalf.

Compliance Impact

This vulnerability could lead to data breaches, compromising personal or sensitive information. For GDPR, it may result in unauthorized access to user data, triggering reporting requirements. For HIPAA, it could expose protected health information, violating compliance standards.

Mitigation Strategies

Immediately update the Profile Builder plugin to version 4.0.1 or later. Disable the affected shortcode if not in use. Audit user roles to ensure no unauthorized contributors have access. Monitor content for injected scripts and remove any detected malicious code.

Hi! I’m here to help you understand CVE-2026-76546. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70