The User Profile Builder plugin fails to escape the current page URL before inserting it into a JavaScript context on one of its administrative pages. This allows an attacker to inject arbitrary script that will execute when a high‑privilege user views that page. The injected code could perform actions such as stealing session cookies, defacing the site, or executing further malicious code on the host system.

The vulnerability affects the WordPress plugin User Profile Builder on all versions earlier than 4.0.1. Any WordPress installation that has this plugin active and an administrator or another user with sufficient privileges is at risk.

The exploit requires the attacker to have authenticated access to the WordPress admin interface, which is typically restricted to site administrators. Once logged in, the attacker can trigger the fault via a crafted link or form submission, leading to script execution in the victim’s browser. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of input sanitization combined with high‑privilege target makes the risk severe.