Stored Cross-Site Scripting Vulnerability in User Profile Builder for WordPress
CVE-2026-111966
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
What is CVE-2026-111966?
The User Profile Builder plugin for WordPress, prior to version 4.0.5, is susceptible to a stored Cross-Site Scripting (XSS) vulnerability. This issue stems from improper sanitization and escaping of a shortcode attribute in redirect messages. Consequently, users with minimal privileges (as low as contributor role) could potentially exploit this flaw to execute malicious scripts, targeting higher-privileged users who interact with the affected form. This vulnerability highlights the importance of implementing rigorous input validation and output sanitization to secure WordPress environments.
Affected Version(s)
User Profile Builder 0 < 4.0.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.