Live › vulnerability › CVE-2026-111966
Go to dashboardThe User Profile Builder WordPress plugin before 4.0.5 does not sanitise or escape one shortcode attribute before printing it in a redirect message. A contributor-level user can store a script that runs in the browser of a higher-privileged user who submits the affected form.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running User Profile Builder older than 4.0.5 that let low-privileged users such as contributors create or edit content containing its shortcodes. Sites on or later, or sites that do not use the plugin, are not affected.
4.0.5No product ranges from the sources yet.
wp plugin get user-profile-builder --field=version4.0.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.
This page as .md · .json · in your agent: get_signal("CVE-2026-111966")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.