CVE-2024-12738: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and clicks a link to show user meta.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12738?
CVE-2024-12738 is rated as a medium severity vulnerability due to its potential for exposing user data through Stored Cross-Site Scripting.
How do I fix CVE-2024-12738?
To fix CVE-2024-12738, you should update the User Profile Builder plugin to version 3.13.0 or higher, which contains the necessary patches.
What type of vulnerability is CVE-2024-12738?
CVE-2024-12738 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the User Profile Builder plugin for WordPress.
Which versions of User Profile Builder are affected by CVE-2024-12738?
CVE-2024-12738 affects all versions of User Profile Builder up to and including 3.12.9.
Who is impacted by CVE-2024-12738?
Users of the affected versions of the User Profile Builder plugin may be vulnerable to attacks that exploit CVE-2024-12738.