UNKNOWN NVD

CVE-2026-76546

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contr

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

References

https://wpscan.com/vulnerability/2c67d682-3e11-4fcd-9aae-ab7895d5da67/

Published: 2026-08-29 · Source: NVD · Feed updated: 2026-08-29

This unknown severity vulnerability was published on 2026-08-29 via NVD.

vulnfeed aggregates 11507 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.