Executive brief
The User Profile Builder plugin for WordPress handles user registration and profile management. A flaw in how the plugin processes user email addresses allows attackers to inject malicious scripts that execute for site administrators viewing the Unconfirmed Email Addresses list, potentially leading to account takeover or unauthorized site changes.
Technical details
The plugin is vulnerable to stored cross-site scripting (XSS) via insufficient input sanitization and output escaping of the 'email' parameter. Unauthenticated attackers can inject arbitrary JavaScript payloads (such as javascript: protocol links) that persist in the database. The vulnerability is triggered when administrators with manage_options capability visit the Users > Unconfirmed Email Addresses list table; the poisoned email data is rendered verbatim into row-action links without proper escaping by the row_actions() function. This allows execution of attacker-controlled scripts in the administrator's browser context.
Affected products
- Wordpress.org User Profile Builder up to and including 4.0.0
Timeline
- 2026-09-01: disclosed