CVE-2026-76546: CWE-79 Cross-Site Scripting (XSS) in User Profile Builder

The User Profile Builder WordPress plugin versions before 4.0.1 contain a stored XSS vulnerability (CWE-79) due to improper output escaping in one optional shortcode. This flaw allows users with contributor privileges to inject malicious scripts that execute when other users, including administrators, view the content generated by the shortcode. The shortcode is disabled by default, reducing exposure. No official patch or remediation level has been published yet. The CVSS v3.1 base score is 6.8, indicating a medium severity vulnerability with network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows a contributor-level user to perform stored XSS attacks against any user viewing the affected shortcode content, including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions executed in the context of the victim's browser. Because the shortcode is optional and not enabled by default, the attack surface is limited to sites where the shortcode is activated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or not enabling the vulnerable shortcode. Restrict contributor privileges carefully and monitor for suspicious shortcode usage. Avoid enabling the optional shortcode until a fix is available.