CVE-2026-111966

MediumCVSS 6.8

Published: 23/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message. This could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

Risk Assessment

A low-privileged user can inject a malicious script that executes in an administrator's or other privileged user's browser. This may lead to session hijacking or actions performed on behalf of the victim.

Recommendation

Update the User Profile Builder plugin to version 4.0.5 or later. Consider limiting contributor roles in production.

Other vulnerabilities in User Profile Builder WordPress plugin

CVE-2026-111982High
The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form. This allows a Multisite subsite Administrator to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

Original NVD description (English source)

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS