CVE-2026-93656 is a stored cross-site scripting vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin. It affects all versions up to and including 4.0.2. The flaw allows authenticated attackers with subscriber-level privileges to inject arbitrary web scripts via the Avatar Field. The injection occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping. Exploitation requires no profile form submission and can be triggered by a nonce-free GET request to /wp-admin/profile.php. The malicious script executes when an administrator accesses the injected user's Edit User screen, potentially compromising administrative sessions.

An attacker with subscriber-level access can inject persistent malicious scripts that execute in the context of an administrator's browser when viewing the affected user's profile. This can lead to limited confidentiality and integrity impacts, such as theft of sensitive information or manipulation of administrative interface elements. The vulnerability does not affect availability and requires authenticated access, but the scope is significant due to the administrative context of execution.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict subscriber-level access where possible and limit administrative users from accessing untrusted user profiles. Applying strict input validation and output escaping on the Avatar Field is recommended once a patch is released.