CVE-2026-75965: User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to place the affected shortcode attribute into a page or other content that will later be viewed by another user.

Q: Is the default plugin configuration affected?

Exploitation requires an administrator to have set the wppb_toolbox_shortcodes_settings[format-date] option to "yes." If that option is not enabled, the affected date shortcode is not active and this issue is not exploitable under the described conditions.

Q: What can be done if an update is not immediately available?

Disable the format-date shortcode by setting wppb_toolbox_shortcodes_settings[format-date] to "no," and restrict or review Contributor-and-higher accounts that can create or edit content. Inspect pages and other editable content for malicious use of the date shortcode attribute.

Published Sep 1, 2026

Updated

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppbtoolboxshortcodessettings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.

Affected Software

1 affected component

WordPress User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor<=4.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/user-profile-builder to a version that resolves this vulnerability.
Fixed in 4.0.0
Configuration
Set wppb_toolbox_shortcodes_settings[format-date] to 'no' so the [format-date] shortcode is not active, preventing exploitation of the Stored Cross-Site Scripting via the 'date' shortcode attribute.
WordPress plugin: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor wppb_toolbox_shortcodes_settings[format-date] = no

Event History

Sep 1, 2026

CVE Published

via MITRE·04:27 AM

Data Sourced

via MITRE·04:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to place the affected shortcode attribute into a page or other content that will later be viewed by another user.

Is the default plugin configuration affected?

Exploitation requires an administrator to have set the wppb_toolbox_shortcodes_settings[format-date] option to "yes." If that option is not enabled, the affected date shortcode is not active and this issue is not exploitable under the described conditions.

What can be done if an update is not immediately available?

Disable the format-date shortcode by setting wppb_toolbox_shortcodes_settings[format-date] to "no," and restrict or review Contributor-and-higher accounts that can create or edit content. Inspect pages and other editable content for malicious use of the date shortcode attribute.

CVE-2026-75965: User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Is the default plugin configuration affected?

What can be done if an update is not immediately available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Is the default plugin configuration affected?

What can be done if an update is not immediately available?