# User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Avatar Image

- **ID:** WPSEC-2026-0889
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.4
- **Fixed in:** 4.0.4 (Update to 4.0.4 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0889/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the avatar image alt text in all versions up to, and including, 4.0.3. This is due to the wppb_changeDefaultAvatar() function building the custom avatar <img> tag from the unescaped alt value, which can hold the user's display name, inside a single-quoted attribute. This makes it possible for authenticated attackers with Subscriber-level access and above, who have uploaded a custom avatar, to inject arbitrary web scripts through their display name. The scripts run whenever a user opens a page that renders their avatar with the display name as alt text.

## References

- https://wpsec.com/vuln/WPSEC-2026-0889/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.4/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0889/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.