CVE-2026-75964: User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manageoptions capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by rowactions().
Affected Software
Event History
Frequently Asked Questions
Who can trigger the malicious script, and who is at risk of executing it?
An unauthenticated attacker can submit a crafted value through the email parameter. The injected script is positioned to execute when an administrator with the manage_options capability opens the Users > Unconfirmed Email Addresses list and interacts with its row-action links.
Are default installations affected?
The available data identifies the vulnerable email-confirmation functionality and the Unconfirmed Email Addresses list table. It does not establish whether that functionality is enabled or present in the plugin's default configuration.
What versions need remediation?
All versions up to and including 4.0.0 are affected. The provided data does not identify a fixed version.
How can administrators look for possible exploitation?
Review entries in Users > Unconfirmed Email Addresses for suspicious email values or row-action links, particularly values that could produce a javascript: URL. Also treat unexpected script execution while interacting with those row actions as an indicator of compromise.