CVE-2026-111948 PUBLISHED

Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions

Assigner: WPScan
Reserved: 17.10.2026 Published: 21.10.2026 Updated: 21.10.2026

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.

Product Status

Vendor Unknown
Product User Profile Builder
Versions Default: unaffected
  • affected from 0 to 4.0.1 (excl.)

Credits

  • 0xBassia finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE