CVE-2026-6431: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

CVE-2026-6431 is a stored cross-site scripting vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin by cozmoslabs. The flaw exists due to insufficient input sanitization and output escaping of the 'Biographical Info' meta field parameter. This allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability affects all plugin versions from 0 up to and including 3.15.7.

Successful exploitation can lead to the execution of arbitrary scripts in the context of users visiting the affected pages, potentially resulting in session hijacking, defacement, or other malicious actions limited to the confidentiality and integrity of user data. The CVSS 3.1 score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and partial impact on confidentiality and integrity but no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected meta field input or implement web application firewall (WAF) rules to detect and block malicious script injection attempts targeting the 'Biographical Info' parameter. Monitor plugin updates from cozmoslabs for an official patch.