CVE-2026-75964 Overview
CVE-2026-75964 is a Stored Cross-Site Scripting [CWE-79] vulnerability in the User Profile Builder plugin for WordPress. The flaw affects all versions up to and including 4.0.0. Insufficient input sanitization and output escaping on the email parameter allow unauthenticated attackers to inject arbitrary web scripts. The payload reaches administrators holding the manage_options capability when they visit the Users > Unconfirmed Email Addresses list and interact with row-action links. The poisoned javascript: href is rendered verbatim into the page HTML by the row_actions() function.
Critical Impact
Unauthenticated attackers can store JavaScript payloads that execute in administrator browsers, enabling session theft, account takeover, or plugin/theme modification through admin actions.
Affected Products
- WordPress User Profile Builder plugin (Beautiful User Registration Forms, User Profiles & User Role Editor)
- All plugin versions up to and including 4.0.0
- WordPress installations using the plugin's email confirmation feature
Discovery Timeline
- 2026-09-01 - CVE-2026-75964 published to the National Vulnerability Database
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-75964
Vulnerability Analysis
The vulnerability resides in the plugin's email confirmation workflow. When a user registers, the plugin stores the submitted email value and later renders it in the wp-admin Users > Unconfirmed Email Addresses list table. The rendering path passes the attacker-controlled email string into WordPress's row_actions() helper without escaping the value as a URL or attribute.
Because the value is written into an href attribute of an anchor tag, an attacker can supply an email-shaped value beginning with javascript: followed by an arbitrary payload. When an administrator hovers or clicks the row action, the browser executes the injected script in the administrator's authenticated session context.
The injection is stored, unauthenticated, and requires only that a privileged user interact with the list table. Successful exploitation can lead to administrator account takeover, creation of rogue users, or backdooring of plugin and theme files.
Root Cause
The root cause is missing output escaping on user-controlled input flowing into an HTML attribute context. The plugin does not validate that the stored email value conforms to a proper email format before rendering, and it does not apply esc_url() or esc_attr() to the value when constructing the row action links. See the plugin source references in the WordPress Profile Builder Class List and WordPress Email Confirmation Class for the vulnerable code paths.
Attack Vector
An unauthenticated attacker submits a registration or email-change request containing a crafted email value with a javascript: scheme and script payload. The plugin stores the value in the unconfirmed email address list. When an administrator with the manage_options capability opens the corresponding admin list table and activates a row action, the browser executes the payload. The vector is network-accessible and requires user interaction from a privileged victim.
See the Wordfence Vulnerability Report for additional exploitation context.
Detection Methods for CVE-2026-75964
Indicators of Compromise
- Rows in the Unconfirmed Email Addresses list where the stored email field contains javascript:, <script, onerror=, or other HTML/JS syntax.
- Unexpected administrator sessions, new admin accounts, or unauthorized changes to plugin or theme files following interaction with the list table.
- Outbound requests from admin browsers to unfamiliar domains shortly after visiting the plugin's admin pages.
Detection Strategies
- Query the WordPress database wp_options or plugin-specific storage for stored email confirmation entries containing non-email characters or the string javascript:.
- Review web server access logs for POST requests to Profile Builder registration or email-change endpoints containing suspicious URL-encoded script fragments.
- Monitor admin sessions for anomalous XHR or fetch traffic originating from the wp-admin users listing page.
Monitoring Recommendations
- Enable WordPress audit logging to capture user registrations, email changes, and role modifications tied to plugin activity.
- Alert on creation of new administrator accounts or elevation events immediately after admin visits to Users > Unconfirmed Email Addresses.
- Deploy a Content Security Policy (CSP) that blocks inline script execution in wp-admin to surface and block payload execution attempts.
How to Mitigate CVE-2026-75964
Immediate Actions Required
- Update the User Profile Builder plugin to the version published in changeset 3666521, which is above 4.0.0.
- Audit the Unconfirmed Email Addresses list and delete any entries containing non-standard characters or script syntax before administrators interact with them.
- Rotate administrator passwords and invalidate active sessions if any suspicious row-action interaction has occurred.
Patch Information
The vendor addressed the vulnerability in the commit referenced by WordPress Profile Builder Changeset 3666521. The fix applies proper escaping to the email value before it is rendered into the row action anchor tag. Administrators should update to the patched release available on the WordPress plugin repository.
Workarounds
- Temporarily disable the Profile Builder email confirmation feature until the plugin is updated.
- Restrict access to the wp-admin users list to trusted IP addresses via web server or WAF rules.
- Deploy a WAF signature that blocks registration requests containing javascript: or common XSS payloads in the email parameter.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.