CVE-2026-107748: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

CVE-2026-107748 describes a stored cross-site scripting vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin by cozmoslabs. The vulnerability exists in all versions up to and including 4.0.3 due to improper neutralization of input in the 'display_name' parameter. Authenticated attackers with subscriber-level privileges or higher can inject persistent malicious scripts into the wp_comments.comment_author field. These scripts execute whenever a user accesses the injected page. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.4, indicating medium severity.

An attacker with subscriber-level access or above can inject persistent malicious scripts that execute in the context of other users viewing the affected pages. This can lead to information disclosure and limited integrity impact. The vulnerability does not affect availability. The persistence of the payload in comment author fields means that changing or removing the attacker's display name does not mitigate the injected script.

No official patch or fix is indicated in the provided data. Users should check the vendor's advisory or plugin updates for remediation. Until a fix is available, restricting subscriber-level user privileges or monitoring for suspicious input may reduce risk. Because this is a stored XSS vulnerability, removing or changing display names does not neutralize the threat. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.