CVE-2026-93656

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs when a malicious attachment URL is planted via a nonce-free GET request to the '/wp-admin/profile.php' endpoint. The injected web scripts execute when an administrator accesses the Edit User screen of the affected user.

Recommendations Update to a version newer than 4.0.2.