The User Profile Builder WordPress plugin allows attackers to store malicious JavaScript via the 'email' parameter. Because the plugin does not sanitize or escape this input, stored XSS can be triggered when administrators view the Unconfirmed Email Addresses list, causing arbitrary script execution in the admin’s browser context, potentially leading to credential theft or defacement.

WordPress sites running any version of the User Profile Builder plugin up to 4.0.0 are affected. The vulnerability exists in the unfiltered handling of the 'email' field used in email confirmation features. All installations of the plugin before the remedy are at risk.

The CVSS score of 6.1 reflects a moderate severity. The EPSS score is not available, so exploitation likelihood is uncertain, but the lack of required authentication means any visitor can inject payloads. The vulnerability is not currently listed in CISA KEV. The likely attack vector is unauthenticated injection of JavaScript via the email parameter, which is rendered verbatim when an admin clicks a row-action link, executing the script in the admin’s session.