The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as… (CVE-2026-76546)

The User Profile Builder WordPress plugin prior to version 4.0.1 does not properly escape output from one of its optional shortcodes. This improper output handling enables users with contributor-level privileges to perform stored cross-site scripting (CWE-79) attacks. When the vulnerable shortcode is enabled and used, malicious scripts can be stored and executed in the context of any user viewing the content, potentially compromising confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.8, reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker with contributor-level access can inject malicious scripts via the vulnerable shortcode, which are then stored and executed in the browsers of users who view the affected content, including administrators. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the privileges of the victim user. The shortcode is optional and not enabled by default, which limits exposure unless explicitly activated.

Upgrade the User Profile Builder plugin to version 4.0.1 or later, where this vulnerability is fixed. Since the shortcode is not enabled by default, disabling or not enabling this shortcode reduces risk. Patch status is not explicitly confirmed in the input data, but the version 4.0.1 indicates a fix. Check the vendor advisory for official confirmation and apply the update promptly.