CVE-2026-111948: Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions

Q: Who is exposed to this issue?

WordPress sites using Cozmoslabs Profile Builder versions earlier than 4.0.1 are affected. The reflected XSS targets high-privilege users who access the affected plugin administration page.

Q: What must an attacker do to exploit it?

An attacker must cause a high-privilege user to visit the affected admin page with a crafted current-page URL. The vulnerable plugin outputs that URL into a JavaScript context without escaping it.

Q: What version resolves the issue?

Upgrade Profile Builder to version 4.0.1 or later. Versions before 4.0.1 are affected.

Published Oct 21, 2026

Updated

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.

Affected Software

1 affected component

Cozmoslabs Profile Builder<4.0.1

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

WordPress sites using Cozmoslabs Profile Builder versions earlier than 4.0.1 are affected. The reflected XSS targets high-privilege users who access the affected plugin administration page.

What must an attacker do to exploit it?

An attacker must cause a high-privilege user to visit the affected admin page with a crafted current-page URL. The vulnerable plugin outputs that URL into a JavaScript context without escaping it.

What version resolves the issue?

Upgrade Profile Builder to version 4.0.1 or later. Versions before 4.0.1 are affected.