The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a… (CVE-2026-111966)

CVE-2026-111966 describes a stored cross-site scripting vulnerability in the User Profile Builder WordPress plugin prior to version 4.0.5. The plugin fails to sanitize and escape one of its shortcode attributes before outputting it in a redirect message. This enables users with contributor roles to inject malicious scripts that execute in the context of higher-privileged users interacting with the affected form. The vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity level with network attack vector, low attack complexity, and requiring user interaction.

Successful exploitation allows an attacker with contributor privileges to execute arbitrary scripts in the browsers of higher-privileged users, potentially leading to credential theft, session hijacking, or other actions performed with elevated privileges. This compromises the confidentiality, integrity, and availability of the affected system from the perspective of privileged users.

A fixed version 4.0.5 of the User Profile Builder plugin addresses this vulnerability by properly sanitizing and escaping the affected shortcode attribute. Users should upgrade to version 4.0.5 or later to remediate this issue. No other mitigations are specified. Patch status is not explicitly confirmed in the input data, but the version number indicates a fix is available in 4.0.5.