This vulnerability (CVE-2026-42385) affects Cozmoslabs Profile Builder Pro versions <= 3.15.0 and is classified as CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS). The issue allows unauthenticated attackers to inject malicious scripts into web pages generated by the product. The CVSS v3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vendor has not provided an official fix or remediation level, and no known exploits in the wild have been reported as of the published date.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in data theft, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the system. The vulnerability is exploitable remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting Profile Builder Pro. Review and sanitize user inputs where possible as a temporary measure.