Live › vulnerability › CVE-2026-111948
Go to dashboardThe User Profile Builder WordPress plugin before 4.0.1 prints the current page URL into JavaScript on one of its admin pages without escaping it. An attacker can build a link that runs script in the browser of a logged-in administrator who opens it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running User Profile Builder older than 4.0.1 are exposed. The attack needs a logged-in high-privilege user to open a crafted link to the plugin's admin page, so sites where only trusted staff use the admin area carry lower practical risk. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get profile-builder --field=version4.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
This page as .md · .json · in your agent: get_signal("CVE-2026-111948")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.