The User Profile Builder plugin does not sanitise the redirect_url attribute supplied in a shortcode before echoing it in a redirect message. This omission enables a stored cross‑site scripting (XSS) payload that can execute in the browser context of higher‑privileged users when they view the affected form response. The weakness aligns with CWE‑79, as malicious user input is reflected without proper escaping.

WordPress sites running the User Profile Builder plugin version earlier than 4.0.5, regardless of other plugins or themes. Any installation that has the vulnerable shortcode in use is susceptible, and all users with elevated roles (administrators, editors) who view the redirect message are at risk.

A user with a Contributor role can submit a form containing a crafted redirect_url value that is stored in the database. When an administrator or editor subsequently loads the response page, the stored value is rendered unescaped, allowing the attacker to run arbitrary client‑side scripts. No CVSS score is provided, but the stored XSS nature suggests a high severity. EPSS data are not available, and the vulnerability is not listed in CISA’s KEV catalog, yet the exploit remains viable on all affected sites until mitigated.