The vulnerability arises from insufficient sanitization and escaping of attributes supplied to the wppb-embed shortcode. An authenticated user with contributor-level permissions can embed malicious JavaScript that is persisted in the post content. When any user views a page containing the injected shortcode, the code runs in their browser and can steal data, hijack sessions or deface sites.

WordPress sites that run the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin by cozmoslabs in versions 3.14.8 or earlier.

The CVSS base score is 6.4, indicating a moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Because the attacker must be authenticated with at least contributor rights, the attack surface is limited to sites where such privileges exist, but once injected, the payload affects all users who visit the affected page. No network‑level exploitation is required; the vector hinges on the plugin’s shortcode processing.