The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress contains a stored Cross‑Site Scripting flaw that can be triggered by unauthenticated attackers when the Email Confirmation feature is active. Attackers can store malicious JavaScript in the First Name field because the plugin fails to sanitize or escape input before saving. The stored script is then executed in the browsers of users who view the affected profile page, providing the attacker with the ability to run arbitrary client‑side code.

The plugin User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor by cozmoslabs runs on WordPress sites. All releases up to and including version 4.0.3 contain the flaw, and the vulnerability is only exploitable when the Email Confirmation feature is turned on.

The CVSS base score of 7.2 characterizes the flaw as high severity. The EPSS score is not available, and the issue is not listed in CISA KEV. The attack vector is through the public registration or profile entry form; an unauthenticated user can inject malicious content that will be stored and later executed when other users view the profile page.