CVE-2026-111948: CWE-79 Cross-Site Scripting (XSS) in User Profile Builder

The User Profile Builder WordPress plugin versions prior to 4.0.1 contain a reflected Cross-Site Scripting (CWE-79) vulnerability. Specifically, the plugin fails to escape the current page URL before outputting it within a JavaScript context on one of its administrative pages. This improper handling allows an attacker to inject malicious scripts that execute in the context of high-privilege users who access the affected admin page, potentially leading to session hijacking or other malicious actions.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of high-privilege users (e.g., administrators) when they visit the affected admin page. This can lead to theft of authentication credentials, session tokens, or other sensitive information accessible to the user, as well as unauthorized actions performed with the user's privileges.

Upgrade the User Profile Builder plugin to version 4.0.1 or later, where this vulnerability has been fixed. Since no official patch link is provided, users should verify the availability of the fixed version from the official plugin repository or vendor. Until upgraded, restrict access to the affected admin pages to trusted users only.