CVE-2026-95866 is a stored cross-site scripting vulnerability in the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor WordPress plugin. Versions up to and including 4.0.2 are affected. The vulnerability occurs because the zero-length multipart file branch in the wppb_save_avatar_value() function writes raw request data directly to user meta, bypassing the usual validation and verification functions (wppb_save_attachment_id() and wppb_verify_attachment_id()). The stored malicious payload is later used as a WordPress attachment URL and rendered without escaping by wppb_default_fields_make_upload_button() when an administrator views the user profile, enabling script execution.

An unauthenticated attacker can inject arbitrary web scripts into user profiles via the avatar field. These scripts execute in the context of an administrator's browser when viewing the affected profile, potentially leading to credential theft, session hijacking, or other malicious actions. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with scope change.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict access to user profile management interfaces to trusted administrators only and consider disabling or removing the plugin if possible. Avoid viewing untrusted user profiles to reduce risk.