Live › vulnerability › CVE-2026-54855
Profile Builder, a WordPress user-profile plugin, has a cross-site scripting flaw in versions up to and including 4.0.5. A visitor without an account can get script into a page that other users load, which can run in their browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Profile Builder plugin at version 4.0.5 or earlier are in the reported range. The sources do not say which plugin features or pages are needed to reach the flaw, so the exact exposure is unknown.
No product ranges from the sources yet.
Version header in the plugin's main file.4.0.5; anything at or below it is in the reported range.4.0.5; the exact fixed version is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-54855")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.