CVE-2026-96338: WordPress Profile Builder plugin <= 4.0.2 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
Affected Software
1 affected component
WordPress Profile Builder<=4.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Profile Builder pluginto a version that resolves this vulnerability.Fixed in 4.0.3
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The issue is described as subscriber XSS, so exploitation requires an attacker to have subscriber-level access to the affected WordPress site.
2
Does exploitation require interaction from another user?
Yes. The CVSS vector includes UI:R, indicating that user interaction is required for exploitation.
3
What is the potential impact if the vulnerability is exploited?
The vulnerability can affect confidentiality, integrity, and availability at a low level. Its CVSS vector also indicates scope change (S:C), meaning the impact may extend beyond the vulnerable component.