Stored Cross-Site Scripting Vulnerability in User Profile Builder Plugin by WordPress

CVE-2026-100186

What is CVE-2026-100186?

The User Profile Builder plugin, designed for creating user registration forms and managing user roles on WordPress, is susceptible to a stored cross-site scripting vulnerability. This issue stems from inadequate input sanitization and output escaping processes in the First Name field. Attackers can exploit this vulnerability by injecting malicious scripts into the names, which will execute on affected pages when accessed by users. This risk amplifies when the Email Confirmation feature is activated, allowing unauthorized users to manipulate content seen by legitimate users. Updating to the latest version is crucial to mitigate this risk.

References