CVE-2026-6431 is a stored cross-site scripting vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin by cozmoslabs. The flaw exists in the handling of the 'Biographical Info' meta field parameter, where input is not properly sanitized or escaped before being rendered on web pages. This enables unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 3.15.7. The CVSS 3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of users viewing the injected content. This can lead to information disclosure and integrity impacts such as session hijacking or defacement. There is no direct impact on availability. The vulnerability affects confidentiality and integrity of user data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the 'Biographical Info' meta field or apply manual input sanitization and output escaping as a temporary mitigation. Monitor vendor channels for updates.