CVE-2026-75965: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor

CVE-2026-75965 is a stored cross-site scripting vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin by cozmoslabs. The flaw exists due to insufficient input sanitization and output escaping of the 'date' shortcode attribute. Authenticated attackers with contributor or higher privileges can inject arbitrary web scripts into pages, which execute upon page access by other users. The vulnerability is exploitable only if the administrator has set the wppb_toolbox_shortcodes_settings[format-date] option to 'yes', activating the vulnerable shortcode. No official patch or remediation level is currently provided by the vendor.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the context of other users viewing the injected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the victim's privileges. The vulnerability does not affect availability but impacts confidentiality and integrity. The attack requires the shortcode to be enabled by an administrator, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the 'format-date' shortcode option (wppb_toolbox_shortcodes_settings[format-date]) to prevent exploitation. Restrict contributor-level access where possible and monitor for suspicious activity related to shortcode usage.