Executive brief
Profile Builder is a popular WordPress plugin for creating user registration forms and managing user profiles. The plugin is vulnerable to stored cross-site scripting (XSS) attacks through the date shortcode feature, allowing authenticated contributors to inject malicious scripts that execute when other users view affected pages. This can lead to account compromise, credential theft, or malware distribution to site visitors.
Technical details
The vulnerability is a stored XSS flaw in the 'date' shortcode attribute handler due to insufficient input sanitization and output escaping. The vulnerable code processes the format-date shortcode without properly sanitizing or escaping user-supplied input. An authenticated attacker with contributor-level access or above can inject arbitrary JavaScript code via the shortcode attribute, which persists in the page content and executes in the browsers of all users who view that page. Exploitation requires an administrator to enable the wppb_toolbox_shortcodes_settings[format-date] option. The vulnerability affects all versions up to and including 4.0.0, and patches should be available in later releases.
Affected products
- Cozmoslabs Profile Builder up to 4.0.0
Timeline
- 2026-09-01: disclosed