Description
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.
Published: 2026-09-25
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

The User Profile Builder plugin for WordPress stores avatar field data without proper input sanitization or output escaping, allowing an unauthenticated attacker to embed malicious scripts into the avatar upload. When a website visitor or administrator loads the page containing the stored avatar URL, the injected script executes in the victim’s browser. This can be used to deface pages, steal session cookies, perform phishing attacks, or load additional malware.

Affected Systems

WordPress sites running the User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin, versions up to and including 4.0.2, developed by cozmoslabs.

Risk and Exploitability

The CVSS base score of 7.2 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the exploit requires an unauthenticated attacker to submit a specially crafted avatar upload, exploiting a zero‑length multipart file branch that bypasses validation. The lack of authentication barrier makes the attack vector likely straightforward, giving the adversary ready access to inject payloads that run whenever affected pages are viewed.

Generated by OpenCVE AI on September 25, 2026 at 09:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the User Profile Builder plugin to a version newer than 4.0.2 that includes proper input validation and output escaping for avatar data.
  • If an immediate upgrade is not possible, temporarily disable avatar upload functionality or restrict the field to allow only trusted image formats and enforce strict file size limits.
  • Implement a content security policy that restricts the execution of inline scripts and loads only from approved domains, reducing the impact of any residual XSS vectors.
  • Enable administrative alerts and monitor user profile pages for unexpected changes or new scripts as an additional detection measure.

Generated by OpenCVE AI on September 25, 2026 at 09:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Cozmoslabs
Cozmoslabs user Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Wordpress
Wordpress wordpress
Vendors & Products Cozmoslabs
Cozmoslabs user Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Wordpress
Wordpress wordpress

Fri, 25 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The zero-length multipart file branch in wppb_save_avatar_value() writes the raw request value directly to user meta, bypassing the wppb_save_attachment_id()/wppb_verify_attachment_id() validation path; the stored payload is later adopted as a WordPress attachment URL and rendered unescaped by wppb_default_fields_make_upload_button() when an administrator views the affected account.
Title User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-25T13:00:15.061Z

Reserved: 2026-09-22T17:00:07.795Z

Link: CVE-2026-95866

cve-icon Vulnrichment

Updated: 2026-09-25T12:55:53.382Z

cve-icon NVD

Status : Deferred

Published: 2026-09-25T08:16:42.307

Modified: 2026-09-25T14:17:25.227

Link: CVE-2026-95866

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T09:15:19Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')