CVE-2026-76546

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.24% chance of exploitation in the next 30 days, 14th percentile

Published

2026-08-29

Updated

2026-08-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2c67d682-3e11-4fcd-9aae-ab7895d5da67/

References

• CVE Record
• NVD entry

Related

• CVE-2026-7654
• CVE-2026-76547
• CVE-2026-7653
• CVE-2026-76548
• CVE-2026-7645
• CVE-2026-76549