# User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.5 - Unauthenticated Cross-Site Scripting via 'email' Parameter in Pending Email Change Notice

- **ID:** WPSEC-2026-2005
- **Plugin:** User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (`profile-builder`), https://wordpress.org/plugins/profile-builder/
- **Affected versions:** all versions before 4.0.6
- **Fixed in:** 4.0.6 (Update to 4.0.6 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/profile-builder
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2005/

## Description

The User Profile Builder plugin for WordPress is vulnerable to Cross-Site Scripting via the 'email' parameter on the Edit Profile form in all versions up to, and including, 4.0.5, due to insufficient input sanitization and output escaping. The plugin's email change confirmation feature runs when the form is displayed, before any validation or nonce check. It stores the raw requested address as a pending email change and then prints it without escaping in the pending email change notice. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that run when a logged-in non-administrator user is tricked into opening a crafted Edit Profile link, and again each time that user returns to the page. The Email confirmation setting for email changes must be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2005/
- https://plugins.svn.wordpress.org/profile-builder/tags/4.0.6/
- https://wordpress.org/plugins/profile-builder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2005/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.