Reflected Cross-Site Scripting Vulnerability in User Profile Builder Plugin by WordPress
CVE-2026-111948
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 21 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111948?
The User Profile Builder plugin for WordPress, prior to version 4.0.1, is susceptible to a reflected cross-site scripting vulnerability. This arises when the plugin fails to properly escape the current page URL, allowing attackers to inject malicious scripts into the admin pages. This exploit particularly affects high-privilege users, making it critical for administrators to update to the latest version to protect against potential attacks.
Affected Version(s)
User Profile Builder 0 < 4.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.