CVE-2026-76546
Low risk· EPSS 5%Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.
Risk Assessment
An attacker can inject malicious script that executes in the administrator's browser, potentially leading to session theft, account takeover, and site security compromise.
Recommendation
Update the plugin to the latest version if available, and ensure the optional shortcode is disabled if not used. Additionally, apply security policies such as Content Security Policy (CSP).
Other vulnerabilities in User Profile Builder
See all- CVE-2026-15826Critical
The User Profile Builder plugin for WordPress up to version 3.16.4 is vulnerable to authentication bypass via type confusion. The wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before performing an is_wp_error() check. When a registration is submitted with a 61–70 character username, WordPress rejects it with a WP_Error object, but absint() coerces that object to the integer 1, causing the plugin to bind and return a transient-backed autologin nonce tied to user ID 1. This allows unauthenticated attackers to log in as the site's Administrator account (user ID 1), resulting in full administrative takeover.
- CVE-2026-76548Low risk· EPSS 3%
The User Profile Builder WordPress plugin before 4.0.1 does not properly restrict its front-end file upload feature, granting unauthenticated visitors capabilities reserved to privileged roles. This allows them to list the site's media library and to modify unpublished posts, pages and media items belonging to other users.
- CVE-2026-76547Low risk· EPSS 13%
The User Profile Builder WordPress plugin before 4.0.1 does not validate the type of data being deserialized when importing a configuration file, allowing high privilege users such as administrators to conduct PHP Object Injection. The affected feature is a free add-on which is disabled by default, and no POP chain is present in the plugin itself, so further impact requires a suitable gadget from another installed plugin.
- CVE-2026-15368High
The User Profile Builder WordPress plugin before version 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.
- CVE-2026-3139Medium
The User Profile Builder plugin for WordPress up to version 3.15.5 is vulnerable to Insecure Direct Object Reference in the wppb_save_avatar_value() function due to missing validation on a user controlled key. Authenticated attackers with subscriber-level access and above can reassign ownership of arbitrary posts and attachments by changing 'post_author'.
Original NVD description (English source)
The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.