CVE-2026-96338
MediumCVSS 6.5Summary
Cross Site Scripting (XSS) vulnerability in Profile Builder up to version 4.0.2. A Subscriber user can inject malicious script.
Risk Assessment
An attacker can steal user sessions or take over accounts, leading to data integrity compromise.
Recommendation
Update the plugin to the latest version that includes the fix.
Other vulnerabilities in Profile Builder
See all- CVE-2026-82607High
A vulnerability in the Profile Builder plugin up to 3.16.1 on WordPress in the wppb_ajax_simple_avatar function of /wp-admin/admin-ajax.php allows unrestricted file upload. The attack can be performed remotely, and the exploit is public.
- CVE-2026-66701Medium
An unauthenticated Broken Access Control vulnerability in the Profile Builder plugin (versions up to 3.16.5) allows an unauthenticated attacker to gain access to functions or data that should be protected.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS