CVE-2026-111966: Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute

Q: Who can exploit this issue, and who is at risk from the resulting script execution?

A user with the Contributor role or higher can exploit the issue. The stored payload targets higher-privileged users who submit the affected form.

Q: What conditions are required for exploitation?

The attacker must be able to use the affected shortcode attribute, redirect_url, and a higher-privileged user must submit the affected form so that the redirect message is rendered.

Q: Which versions are affected?

Profile Builder versions before 4.0.5 are affected.

Published Oct 23, 2026

Updated

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

Affected Software

1 affected component

Cozmoslabs Profile Builder<4.0.5

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the resulting script execution?

A user with the Contributor role or higher can exploit the issue. The stored payload targets higher-privileged users who submit the affected form.

What conditions are required for exploitation?

The attacker must be able to use the affected shortcode attribute, redirect_url, and a higher-privileged user must submit the affected form so that the redirect message is rendered.

Which versions are affected?

Profile Builder versions before 4.0.5 are affected.

CVE-2026-111966: Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the resulting script execution?

What conditions are required for exploitation?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the resulting script execution?

What conditions are required for exploitation?

Which versions are affected?