{"id":"CVE-2026-107748","kind":"vulnerability","aliases":["CVE-2026-107748"],"related":[],"title":"WordPress User Profile Builder plugin: stored XSS via display_name up to 4.0.3","description":"The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload persists in wp_comments.comment_author independently of the user account, so removing or changing the attacker's display name after the comment is posted does not neutralize the stored script.","summary":"The User Profile Builder WordPress plugin does not sanitize the display_name field, so a logged-in subscriber can store a script that runs in the browser of anyone who views the injected page. The payload persists in the comment author field even after the display name is changed.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","plugin-updated","registration-disabled"],"how_to_check":"- Check the installed version of User Profile Builder in the WordPress plugins screen or with `wp plugin get profile-builder --field=version`\n- Look for stored comments or pages containing script tags in comment_author in the wp_comments table","fix":"- Update User Profile Builder to a version later than `4.0.3` once the vendor publishes one (unknown: fixed version not stated in the sources)\n- Remove any injected script from wp_comments.comment_author after updating","status":"open","published_at":"2026-10-16T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:59:54+00:00","updated_at":"2026-10-25T03:59:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:59:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update User Profile Builder to a version later than `4.0.3` once the vendor publishes one (unknown: fixed version not stated in the sources)\n- Remove any injected script from wp_comments.comment_author after updating","reach":"internet","title":"WordPress User Profile Builder plugin: stored XSS via display_name up to 4.0.3","impact":"medium","summary":"The User Profile Builder WordPress plugin does not sanitize the display_name field, so a logged-in subscriber can store a script that runs in the browser of anyone who views the injected page. The payload persists in the comment author field even after the display name is changed.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"script runs in other users' browsers, enabling session theft","analyst_note":"","how_to_check":"- Check the installed version of User Profile Builder in the WordPress plugins screen or with `wp plugin get profile-builder --field=version`\n- Look for stored comments or pages containing script tags in comment_author in the wp_comments table","needs_analyst":false,"not_affected_if":["plugin-not-installed","registration-disabled","plugin-updated"],"who_is_affected":"Sites running User Profile Builder version 4.0.3 or earlier where subscriber-level or higher accounts can register or log in. Sites that do not allow public or subscriber registration and do not use this plugin can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000618,"input_tokens":3442,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107748':16A,19A '-2026':15A,18A '4.0.3':13A,114C 'access':134C,150C 'account':164C 'anyon':57B 'arbitrari':139C 'attack':129C,170C 'authent':128C 'author':69B,159C 'beauti':82C 'browser':55B 'builder':4A,31B,81C 'chang':77B,168C 'comment':68B,176C 'cross':99C 'cross-sit':98C 'cve':14A,17A 'display':9A,38B,74B,104C,172C 'due':115C 'editor':90C 'escap':122C 'even':71B 'execut':146C 'field':40B,70B 'form':85C 'host':23B 'includ':113C 'independ':160C 'inject':61B,138C,152C 'input':118C 'insuffici':117C 'level':133C 'log':44B 'logged-in':43B 'make':124C 'name':10A,39B,75B,105C,173C 'neutral':181C 'output':121C 'packag':20B 'page':62B,143C,153C 'paramet':106C 'payload':64B,155C 'persist':65B,156C 'plugin':5A,27B,33B,91C 'possibl':126C 'post':178C 'profil':3A,30B,80C,87C 'registr':84C 'remov':166C 'role':89C 'run':52B 'sanit':36B,119C 'script':50B,101C,141C,184C 'self':22B 'self-host':21B 'site':100C 'store':6A,48B,97C,183C 'subscrib':46B,132C 'subscriber-level':131C 'user':2A,29B,79C,83C,86C,88C,149C,163C 'version':109C 'via':8A,102C 'view':59B 'vulner':95C 'web':140C 'whenev':147C 'wordpress':1A,24B,26B,32B,93C 'wordpress-plugin':25B 'wp_comments.comment':158C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running User Profile Builder version 4.0.3 or earlier where subscriber-level or higher accounts can register or log in. Sites that do not allow public or subscriber registration and do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107748","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107748","severity":null,"published_at":"2026-10-16T06:17:05+00:00","modified_at":"2026-10-16T15:17:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}