{"id":"CVE-2026-54855","kind":"vulnerability","aliases":["CVE-2026-54855"],"related":[],"title":"Profile Builder WordPress plugin: unauthenticated XSS through versions 4.0.5","description":"Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.","summary":"Profile Builder, a WordPress user-profile plugin, has a cross-site scripting flaw in versions up to and including 4.0.5. A visitor without an account can get script into a page that other users load, which can run in their browsers.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","profile-builder","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Profile Builder version in the WordPress admin plugins list, or read the `Version` header in the plugin's main file.\n- Compare the version against `4.0.5`; anything at or below it is in the reported range.","fix":"- Move Profile Builder to a version later than `4.0.5`; the exact fixed version is unknown.","status":"open","published_at":"2026-10-30T19:18:26+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:26:02+00:00","updated_at":"2026-10-30T19:26:02+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:02Z","model":"claude-haiku-5-5","output":{"fix":"- Move Profile Builder to a version later than `4.0.5`; the exact fixed version is unknown.","reach":"internet","title":"Profile Builder WordPress plugin: unauthenticated XSS through versions 4.0.5","impact":"medium","summary":"Profile Builder, a WordPress user-profile plugin, has a cross-site scripting flaw in versions up to and including 4.0.5. A visitor without an account can get script into a page that other users load, which can run in their browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","profile-builder","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in other users' browsers on the site.","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and the affected input path.","how_to_check":"- Check the installed Profile Builder version in the WordPress admin plugins list, or read the `Version` header in the plugin's main file.\n- Compare the version against `4.0.5`; anything at or below it is in the reported range.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Profile Builder plugin at version 4.0.5 or earlier are in the reported range. The sources do not say which plugin features or pages are needed to reach the flaw, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4066,"output_tokens":543,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-54855':12A,15A '4.0.5':9A,45B,75C 'account':50B 'browser':66B 'builder':2A,19B,25B,74C 'cross':35B,68C 'cross-sit':34B 'cve':10A,13A 'flaw':38B 'get':52B 'host':22B 'includ':44B 'load':60B 'packag':16B 'page':56B 'plugin':4A,31B 'profil':1A,18B,24B,30B,73C 'profile-build':17B 'run':63B 'script':37B,53B,70C 'self':21B 'self-host':20B 'site':36B,69C 'unauthent':5A,67C 'user':29B,59B 'user-profil':28B 'version':8A,40B,76C 'visitor':47B 'without':48B 'wordpress':3A,23B,27B 'xss':6A,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Profile Builder plugin at version 4.0.5 or earlier are in the reported range. The sources do not say which plugin features or pages are needed to reach the flaw, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54855","severity":null,"published_at":"2026-10-30T19:18:26+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}