The User Profile Builder plugin for WordPress contains a stored cross‑site scripting flaw that allows an attacker who is logged in as a subscriber or higher to inject arbitrary JavaScript through the 'display_name' field. Because the plugin does not sanitize or escape the input before storing it in the database and also fails to escape the output when rendering the value, the malicious code is saved in wp_comments.comment_author and will run whenever a page that displays that comment is viewed. The injected payload remains active even if the attacker later changes or deletes the author name associated with the comment, meaning the XSS persists until the comment itself is removed.

WordPress sites that have installed any version of the User Profile Builder plugin up to and including 4.0.3 are affected. Users with subscriber or higher capabilities can exploit the vulnerability by creating or editing a comment that contains a harmful script in the display_name field. Any publicly accessible page that renders the affected comments will expose other visitors to the stored script.

The CVSS score of 6.4 signals a moderate severity. The EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low at present, and the issue is not listed in CISA’s KEV catalog. However, because the flaw requires only authenticated access and many WordPress sites grant subscriber access to a large user base, the attack surface is significant. Exploitation is straightforward: after posting or editing a comment, the attacker places malicious JavaScript into the display_name field; when any user visits a page that displays the comment, the attacker’s code executes in the victim’s browser context.