The User Profile Builder plugin for WordPress by cozmoslabs suffers from a stored cross-site scripting vulnerability (CWE-79) identified as CVE-2024-12738. This vulnerability exists in all versions up to 3.12.9 due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of user meta parameters. An unauthenticated attacker can inject malicious scripts that execute when users access affected pages and interact with user meta links. The CVSS 3.1 score of 6.1 reflects a medium severity with network attack vector and user interaction required. No patch or official remediation details are currently available, and no known exploits have been reported.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of users visiting the affected pages, potentially leading to confidentiality and integrity impacts such as theft of user data or session tokens. Availability is not impacted. The vulnerability requires user interaction to trigger the script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict who can submit user meta data, sanitize inputs manually if possible, and avoid clicking suspicious links related to user meta. Monitoring vendor channels for updates is recommended.