CVE-2026-100186: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

CVE-2026-100186 is a stored XSS vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin by cozmoslabs. Versions from 0 through 4.0.3 are affected. The vulnerability is due to improper neutralization of input in the First Name field, enabling unauthenticated attackers to inject arbitrary web scripts. The vulnerability is exploitable only when the Email Confirmation feature is enabled. The CVSS 3.1 score is 7.2 (high severity) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with scope change.

An unauthenticated attacker can inject persistent malicious scripts via the First Name field, which execute in the context of users who view the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The vulnerability affects confidentiality and integrity but does not impact availability.

No official patch or fix is currently documented. Users should verify the vendor advisory for updates. Until a fix is available, consider disabling the Email Confirmation feature to prevent exploitability. Monitor vendor channels for patch releases and apply updates promptly once available.