CVE-2026-75964

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.1

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By injecting arbitrary web scripts via the email parameter, an attacker can execute scripts in the browser of users who access the affected page. Specifically, administrators with the manage options capability are targeted when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the row actions() function renders the poisoned javascript: href directly into the page HTML.

Recommendations Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to version 4.0.1 or later.