PT-2026-83402
CVE-2026-76546
·
تاريخ النشر
2026-08-29
·
تاريخ التحديث
2026-08-30
الوصف من
CVSS 3.1
6.8
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
User Profile Builder versions prior to 4.0.1
Description
Stored Cross-Site Scripting (XSS) occurs because the plugin fails to escape the output of an optional shortcode. This allows users with contributor roles or higher to execute malicious scripts against any user who views the affected content, including administrators. The shortcode is disabled by default.
Recommendations
Update User Profile Builder to version 4.0.1 or later.
As a temporary mitigation, ensure the optional shortcode remains disabled.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾