Feelsoclean

**Name of the Vulnerable Software and Affected Versions** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when a malicious attachment URL is planted via a nonce-free GET request to the '/wp-admin/profile.php' endpoint. The injected web scripts execute when an administrator accesses the Edit User screen of the affected user. **Recommendations** Update to a version newer than 4.0.2.