The User Profile Builder plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its wppb-embed shortcode. This vulnerability arises from improper neutralization of input during web page generation, specifically due to insufficient input sanitization and output escaping of user-supplied shortcode attributes. Authenticated attackers with contributor-level privileges or higher can exploit this flaw to inject arbitrary JavaScript code that executes in the context of other users viewing the compromised pages. The vulnerability affects all plugin versions up to 3.14.8. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. There is no vendor advisory or patch link provided, and no known active exploitation has been reported.

Successful exploitation allows an authenticated user with contributor or higher privileges to inject and execute arbitrary scripts in the context of other users visiting the affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of other users. Availability is not impacted. The medium CVSS score reflects these impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access and above to trusted users only. Monitor plugin updates from cozmoslabs and apply any released patches promptly. Consider disabling or restricting use of the wppb-embed shortcode if feasible.