User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Cross-Site Scripting via 'email' Parameter in Pending Email Change Notice
- ID
- WPSEC-2026-2005
- Plugin
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (profile-builder)
- Affected
- all versions before 4.0.6
- Remediation
- Update to 4.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor on WPSec AttackSurface
- Fix released
- Published
Description
The User Profile Builder plugin for WordPress is vulnerable to Cross-Site Scripting via the 'email' parameter on the Edit Profile form in all versions up to, and including, 4.0.5, due to insufficient input sanitization and output escaping. The plugin's email change confirmation feature runs when the form is displayed, before any validation or nonce check. It stores the raw requested address as a pending email change and then prints it without escaping in the pending email change notice. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when a logged-in non-administrator user is tricked into opening a crafted Edit Profile link, and again each time that user returns to the page. The Email confirmation setting for email changes must be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2005/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/
- https://wordpress.org/plugins/profile-builder/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS