CVE-2026-76546

Name of the Vulnerable Software and Affected Versions User Profile Builder versions prior to 4.0.1

Description Stored Cross-Site Scripting (XSS) occurs because the plugin fails to escape the output of an optional shortcode. This allows users with contributor roles or higher to execute malicious scripts against any user who views the affected content, including administrators. The shortcode is disabled by default.

Recommendations Update User Profile Builder to version 4.0.1 or later. As a temporary mitigation, ensure the optional shortcode remains disabled.