CVE-2026-93656: User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user's Edit User screen.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is most likely to be affected by the payload?
An authenticated WordPress user with Subscriber-level access or any higher role can exploit it. The stored script is described as executing when an administrator opens the affected user's Edit User screen.
Does exploitation require submitting a profile form or obtaining a nonce?
No. The issue is exploitable through a nonce-free GET request to /wp-admin/profile.php and does not require profile-form submission.
What input is used to store the malicious script payload?
The attacker can plant a malicious attachment URL through the Avatar field. Insufficient sanitization and output escaping allow that value to become stored cross-site scripting content.
How can administrators identify potentially affected accounts?
Review user profile Avatar field values, particularly for subscriber or other lower-privileged accounts, for unexpected or suspicious attachment URLs. Opening an affected user's Edit User screen may trigger the stored payload.