PT-2026-83402 · WordPress · User Profile Builder
CVE-2026-76546
·
Published
2026-08-29
·
Updated
2026-08-30
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
User Profile Builder versions prior to 4.0.1
Description
Stored Cross-Site Scripting (XSS) occurs because the plugin fails to escape the output of an optional shortcode. This allows users with contributor roles or higher to execute malicious scripts against any user who views the affected content, including administrators. The shortcode is disabled by default.
Recommendations
Update User Profile Builder to version 4.0.1 or later.
As a temporary mitigation, ensure the optional shortcode remains disabled.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
User Profile Builder