CVE-2026-75964: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

CVE-2026-75964 is a stored cross-site scripting vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin by cozmoslabs. The flaw exists in all versions up to 4.0.0 due to improper neutralization of input during web page generation, specifically in the handling of the 'email' parameter. An unauthenticated attacker can inject arbitrary JavaScript payloads that execute in the context of administrators with the manage_options capability when they access the Users > Unconfirmed Email Addresses list table. The vulnerability stems from the row_actions() function rendering poisoned javascript: href attributes verbatim without proper sanitization or escaping.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of administrators with high privileges, potentially leading to session hijacking, privilege escalation, or other malicious actions within the WordPress admin interface. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, administrators should exercise caution when accessing the Unconfirmed Email Addresses list and consider restricting access to trusted users only. Monitoring for suspicious input in the 'email' parameter and applying web application firewall rules to block malicious payloads may provide temporary mitigation.