{"id":"CVE-2026-111966","kind":"vulnerability","aliases":["CVE-2026-111966"],"related":[],"title":"User Profile Builder WordPress plugin: shortcode attribute enables stored XSS","description":"The User Profile Builder  WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.","summary":"The User Profile Builder WordPress plugin before 4.0.5 does not sanitise or escape one shortcode attribute before printing it in a redirect message. A contributor-level user can store a script that runs in the browser of a higher-privileged user who submits the affected form.","severity":"medium","cvss":6.8,"epss":0.00153,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","user-profile-builder","wordpress","wordpress-plugin"],"not_affected_if":["plugin-not-installed","plugin-version-4.0.5-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get user-profile-builder --field=version`\n- Review whether contributor or similar low-privilege accounts can create content that embeds the plugin's shortcodes","fix":"- Update User Profile Builder to `4.0.5` or later","status":"open","published_at":"2026-10-23T06:17:05+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:42:37+00:00","updated_at":"2026-10-25T03:42:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:42:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update User Profile Builder to `4.0.5` or later","reach":"internet","title":"User Profile Builder WordPress plugin: shortcode attribute enables stored XSS","impact":"medium","summary":"The User Profile Builder WordPress plugin before 4.0.5 does not sanitise or escape one shortcode attribute before printing it in a redirect message. A contributor-level user can store a script that runs in the browser of a higher-privileged user who submits the affected form.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","user-profile-builder"],"confidence":0.7,"needs_auth":"yes","worst_case":"script runs in admin sessions, enabling session theft or account takeover","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get user-profile-builder --field=version`\n- Review whether contributor or similar low-privilege accounts can create content that embeds the plugin's shortcodes","needs_analyst":false,"not_affected_if":["plugin-version-4.0.5-or-later","plugin-not-installed"],"who_is_affected":"Sites running User Profile Builder older than `4.0.5` that let low-privileged users such as contributors create or edit content containing its shortcodes. Sites on `4.0.5` or later, or sites that do not use the plugin, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000599,"input_tokens":3368,"output_tokens":524,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111966':13A,16A '-2026':12A,15A '4.0.5':33B,81C 'affect':72B,127C 'allow':102C 'attack':118C 'attribut':7A,41B,91C 'back':95C 'browser':62B 'builder':3A,21B,29B,77C 'contributor':51B,110C 'contributor-level':50B 'could':101C 'cross':115C 'cross-sit':114C 'cve':11A,14A 'enabl':8A 'escap':38B,86C 'form':73B,128C 'higher':66B,121C 'higher-privileg':65B,120C 'level':52B 'low':108C 'messag':48B,99C 'one':39B,87C 'output':93C 'packag':17B 'perform':112C 'plugin':5A,25B,31B,79C 'print':43B 'privileg':67B,122C 'profil':2A,20B,28B,76C 'redirect':47B,98C 'role':106C 'run':59B 'sanitis':36B,84C 'script':57B,117C 'shortcod':6A,40B,90C 'site':116C 'store':9A,55B,113C 'submit':70B,125C 'user':1A,19B,27B,53B,68B,75C,103C,123C 'user-profile-build':18B 'wordpress':4A,22B,24B,30B,78C 'wordpress-plugin':23B 'xss':10A","nicknames":[],"mitigations":[],"who_affected":"Sites running User Profile Builder older than `4.0.5` that let low-privileged users such as contributors create or edit content containing its shortcodes. Sites on `4.0.5` or later, or sites that do not use the plugin, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T06:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111966","severity":null,"published_at":"2026-10-23T06:17:05+00:00","modified_at":"2026-10-23T14:20:57+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111966","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111966","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}