CVE-2026-75965

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the date shortcode attribute. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute when a user visits the affected page. Exploitation requires an administrator to have the wppb toolbox shortcodes settings[format-date] option set to 'yes' to activate the shortcode.

Recommendations Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to version 4.0.1 or later. As a temporary mitigation, set the wppb toolbox shortcodes settings[format-date] option to 'no' to disable the vulnerable shortcode.