{"id":"CVE-2026-100186","kind":"vulnerability","aliases":["CVE-2026-100186"],"related":[],"title":"WordPress User Profile Builder: stored XSS via First Name field","description":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.","summary":"The User Profile Builder WordPress plugin, up to and including 4.0.3, does not sanitize the First Name field on registration. An unauthenticated attacker can store a script there that runs in the browser of any user who opens an affected page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["default-config","plugin-updated"],"how_to_check":"- Check the installed version of the User Profile Builder plugin in the WordPress admin plugins list; versions up to and including `4.0.3` are affected.\n- Confirm whether the Email Confirmation feature is enabled in the plugin settings; the sources say the flaw is only exploitable when it is on.","fix":"- Update User Profile Builder to a version later than `4.0.3`; the sources do not name the fixed version, so check the plugin changelog.\n- Until patched, disable the Email Confirmation feature if it is not needed.","status":"open","published_at":"2026-10-16T06:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:29:53+00:00","updated_at":"2026-10-25T03:29:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:29:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update User Profile Builder to a version later than `4.0.3`; the sources do not name the fixed version, so check the plugin changelog.\n- Until patched, disable the Email Confirmation feature if it is not needed.","reach":"internet","title":"WordPress User Profile Builder: stored XSS via First Name field","impact":"medium","summary":"The User Profile Builder WordPress plugin, up to and including 4.0.3, does not sanitize the First Name field on registration. An unauthenticated attacker can store a script there that runs in the browser of any user who opens an affected page.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker script runs in visitors' and admins' browsers, stealing sessions.","analyst_note":"Confirm the fixed version and whether admin pages render the First Name field; see the NVD entry linked in the sources.","how_to_check":"- Check the installed version of the User Profile Builder plugin in the WordPress admin plugins list; versions up to and including `4.0.3` are affected.\n- Confirm whether the Email Confirmation feature is enabled in the plugin settings; the sources say the flaw is only exploitable when it is on.","needs_analyst":true,"not_affected_if":["default-config","plugin-updated"],"who_is_affected":"Sites running User Profile Builder up to and including 4.0.3 with the Email Confirmation feature enabled are exposed, since registration input is stored and rendered to visitors. Sites with the plugin absent or on a later version, or with Email Confirmation off, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":3407,"output_tokens":600,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100186':13A,16A '-2026':12A,15A '4.0.3':32B,98C 'access':127C 'affect':61B 'arbitrari':116C 'attack':44B,113C 'beauti':67C 'browser':54B 'builder':4A,25B,66C,145C 'confirm':139C 'cross':84C 'cross-sit':83C 'cve':11A,14A 'due':99C 'editor':75C 'email':138C 'enabl':142C 'escap':106C 'execut':123C 'exploit':135C 'featur':140C 'field':10A,39B,90C 'first':8A,37B,88C 'form':70C 'host':20B 'includ':31B,97C 'inject':115C,129C 'input':102C 'insuffici':101C 'make':108C 'name':9A,38B,89C 'open':59B 'output':105C 'packag':17B 'page':62B,120C,130C 'plugin':27B,76C 'possibl':110C 'profil':3A,24B,65C,72C,144C 'registr':41B,69C 'role':74C 'run':51B 'sanit':35B,103C 'script':48B,86C,118C 'self':19B 'self-host':18B 'site':85C 'store':5A,46B,82C 'unauthent':43B,112C 'user':2A,23B,57B,64C,68C,71C,73C,126C 'version':93C 'via':7A,87C 'vulner':80C,132C 'web':117C 'whenev':124C 'wordpress':1A,21B,26B,78C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running User Profile Builder up to and including 4.0.3 with the Email Confirmation feature enabled are exposed, since registration input is stored and rendered to visitors. Sites with the plugin absent or on a later version, or with Email Confirmation off, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100186","severity":null,"published_at":"2026-10-16T06:17:02+00:00","modified_at":"2026-10-16T15:16:58+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}