The User Profile Builder plugin for WordPress contains a stored XSS vulnerability (CWE-79) in the 'gdpr_communication_preferences[]' parameter. This flaw allows authenticated users with at least Subscriber privileges to inject arbitrary JavaScript code into pages, which executes when viewed by others. The vulnerability requires the GDPR Communication Preferences module to be enabled and configured with at least one field on the profile edit form. The root cause is insufficient sanitization and escaping of user input before rendering it in web pages. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to inject persistent malicious scripts into the website. These scripts execute in the context of other users viewing the affected pages, potentially leading to theft of session tokens, defacement, or other actions limited by the scope of the XSS. The vulnerability does not impact availability. The overall impact is limited to confidentiality and integrity with medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the GDPR Communication Preferences module or removing GDPR Communication Preferences fields from the edit profile form to prevent exploitation. Additionally, restrict user roles that can access profile editing to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.