The vulnerability is a stored cross‑site scripting flaw caused by unsanitized output from a shortcode. Users with a Contributor role can inject arbitrary JavaScript or HTML into the content, which is then rendered for anyone viewing the affected page, including site administrators. The injection can lead to session hijacking, data theft, or defacement, and is categorized as CWE‑79.

Affects the User Profile Builder WordPress plugin in all releases prior to version 4.0.1. The insecure shortcode is not enabled by default, so only sites that have activated it are susceptible. The vulnerability applies to any user who can publish content using that shortcode, including contributors and higher‑privileged roles.

The CVSS base score is 6.8, and the EPSS score is < 1%, but the risk remains high because the flaw allows automated code execution in the browsers of privileged users. The attack vector is inferred to be local to the WordPress installation; an author or contributor simply embeds malicious payloads into a post or field that contains the vulnerable shortcode. Once stored, the code executes whenever the content is rendered, which can affect administrators with no further action required. Given its ability to subvert sensitive operations and data, patching or mitigation is strongly recommended.