The User Profile Builder plugin is vulnerable to stored XSS via the gdpr_communication_preferences[] parameter. The flaw stems from insufficient input sanitization and output escaping, allowing an attacker to inject scripts that execute on pages where the preference is displayed. The impact is that an authenticated user with Subscriber or higher privileges can run arbitrary JavaScript in the context of site visitors, potentially enabling credential theft, session hijacking, or defacement. The weakness is classified as CWE-79 Cross‑Site Scripting.

All installations of the WordPress plugin "User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor" on version 3.14.3 or earlier are affected. The vulnerability is present only when the GDPR Communication Preferences module is enabled and at least one preferences field has been added to a user profile. Earlier or newer plugin versions are not impacted.

The CVSS score of 6.4 indicates a moderate to high severity. The EPSS score is below 1 %, suggesting that the likelihood of the vulnerability being actively exploited is quite low at present. The vulnerability is not listed in CISA’s KEV catalog. Externally, the attack requires an authenticated account with Subscriber level or higher and the ability to edit profile preferences, typically granted to regular users with a suitable role. An attacker can therefore add malicious code through the preferences field, which will be stored and displayed to visitors, enabling exploitation. While the likelihood of exploitation is low, the potential impact remains significant due to the ability to execute arbitrary JavaScript during page loads.