---
id: "CVE-2026-111948"
kind: "vulnerability"
aliases: ["CVE-2026-111948"]
title: "User Profile Builder WordPress plugin: reflected XSS on admin pages"
severity: "high"
cvss: 7.1
epss: 0.00155
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-not-installed", "plugin-version-4.0.1-or-later"]
published_at: "2026-10-21T06:16:48+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:31:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111948", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111948", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# User Profile Builder WordPress plugin: reflected XSS on admin pages

The User Profile Builder WordPress plugin before 4.0.1 prints the current page URL into JavaScript on one of its admin pages without escaping it. An attacker can build a link that runs script in the browser of a logged-in administrator who opens it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of User Profile Builder in the WordPress admin plugin list or with `wp plugin get profile-builder --field=version`
- Confirm whether the site has administrators who browse while logged in and click links from outside

## Fix

- Update User Profile Builder to `4.0.1` or later

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111948
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111948

## From the sources

The User Profile Builder  WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_