Stored Cross-Site Scripting Vulnerability in Profile Builder Plugin for WordPress
CVE-2025-4671
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 June 2025
What is CVE-2025-4671?
The Profile Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping on user-supplied attributes. This vulnerability allows authenticated users with contributor-level access and higher to exploit the user_meta and compare shortcodes, injecting arbitrary web scripts that execute whenever other users access affected pages. If left unaddressed, this security flaw poses a significant risk to the integrity of user data and the overall safety of WordPress installations.
Affected Version(s)
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor * <= 3.13.8