CVE-2026-6431: User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editorto a version that resolves this vulnerability.Fixed in 3.15.7
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker can exploit it; no WordPress account or other privileges are required.
Which installations are affected?
WordPress sites using User Profile Builder versions up to and including 3.15.7 are affected. The vulnerable input is the Biographical Info meta field.
What is the impact after a successful injection?
An attacker can store arbitrary web script in an affected page. The script executes when a user accesses that injected page, with potential confidentiality and integrity impact.