Subscriber XSS in Profile Builder Plugin

Executive Summary

This is a Subscriber Cross Site Scripting (XSS) vulnerability in the WordPress Profile Builder plugin versions 4.0.2 and below. It allows attackers to inject malicious scripts through crafted links, pages, or form submissions that privileged users interact with. The vulnerability has a CVSS score of 6.5, indicating moderate severity.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in Profile Builder <= 4.0.2, check if the plugin version is 4.0.2 or below. Inspect user input fields for suspicious script tags or event handlers like onerror, onload, or onclick. Monitor for unexpected script executions in browser consoles when interacting with user profile pages.

Useful 0 Not Useful 0

Impact Analysis

Attackers could exploit this to steal visitor data or hijack accounts by injecting malicious scripts. Successful exploitation requires a privileged user to interact with a malicious link or form, potentially affecting websites using vulnerable versions of the plugin.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Profile Builder to version 4.0.3 or later. If updating is not possible, apply Patchstack's mitigation rule or disable the plugin until an update is available. Enable auto-updates for vulnerable plugins to prevent future issues.

Useful 0 Not Useful 0