CVE-2026-75965: WordPress User Profile Builder XSS Vulnerability

CVE-2026-75965 Overview

CVE-2026-75965 is a Stored Cross-Site Scripting (XSS) vulnerability in the User Profile Builder plugin for WordPress. The flaw affects all plugin versions up to and including 4.0.0. It stems from insufficient input sanitization and output escaping on the date attribute of the plugin's format-date shortcode. Authenticated users with contributor-level access or above can inject arbitrary JavaScript into pages. The malicious script executes whenever another user views the affected page. Exploitation requires an administrator to have enabled the wppb_toolbox_shortcodes_settings[format-date] option, which activates the vulnerable shortcode. The issue is tracked under CWE-79.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of any user visiting an affected page, enabling session theft, admin account takeover, and site redirection.

Affected Products

WordPress plugin: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
All versions up to and including 4.0.0
Installations where wppb_toolbox_shortcodes_settings[format-date] is enabled

Discovery Timeline

2026-09-01 - CVE-2026-75965 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-75965

Vulnerability Analysis

The vulnerability resides in the plugin's format-date shortcode handler located at admin/advanced-settings/includes/shortcodes/format-date.php. The shortcode accepts a date attribute supplied through user-generated content. The handler does not sanitize the attribute value on input and does not escape it before writing it back to the rendered HTML output. An authenticated contributor can embed the shortcode in a post or page and pass a crafted date value that contains HTML or JavaScript payloads. When an editor, administrator, or site visitor loads the page, the browser parses the injected markup and executes attacker-controlled script in the context of the site origin.

The exploit path depends on a prerequisite configuration state. An administrator must have set the wppb_toolbox_shortcodes_settings[format-date] option to yes, which registers the shortcode as active. Without this option enabled, the shortcode does not render and the injection surface is inert. The vendor addressed the flaw in changeset 3666521.

Root Cause

The root cause is a missing call to WordPress sanitization primitives such as sanitize_text_field() on the incoming date shortcode attribute and a missing call to escaping primitives such as esc_html() or esc_attr() on the output. This classifies as Stored XSS [CWE-79] because the payload persists in post content within the database and executes on every subsequent render.

Attack Vector

The attack requires network access, low privileges (contributor role), and no user interaction beyond a target navigating to the affected page. The scope is changed because the injected script executes in the browser of a different user than the one who submitted it. See the vulnerable source lines in the format-date.php shortcode handler for the unsanitized attribute flow. No verified public exploit code is currently available; the vulnerability mechanism is documented in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-75965

Indicators of Compromise

Post or page content containing the plugin's format-date shortcode with a date attribute holding HTML tags such as <script>, <img onerror=>, or <svg onload=>.
Newly created or modified posts by contributor-level accounts that render unusual client-side behavior.
Outbound browser requests to unfamiliar third-party domains originating from admin sessions viewing affected pages.

Detection Strategies

Review the wp_posts table for shortcode invocations that include suspicious characters or encoded payloads within the date attribute.
Enumerate plugin versions across managed WordPress sites and flag any User Profile Builder install at version 4.0.0 or earlier.
Audit the wppb_toolbox_shortcodes_settings option in wp_options to identify sites where the format-date shortcode is enabled and therefore exploitable.

Monitoring Recommendations

Log and alert on post edits performed by contributor-level accounts, particularly when new shortcodes are introduced.
Deploy a Content Security Policy (CSP) that restricts inline scripts and unauthorized external script sources to constrain XSS payload execution.
Monitor administrator session cookies and privileged account activity for anomalous API calls that could indicate post-exploitation account takeover.

How to Mitigate CVE-2026-75965

Immediate Actions Required

Update the User Profile Builder plugin to the version released in changeset 3666521 or later.
If patching is not immediately possible, set the wppb_toolbox_shortcodes_settings[format-date] option to disabled to deactivate the vulnerable shortcode.
Audit existing posts and pages for pre-existing malicious shortcode content and remove any suspicious entries.
Rotate credentials for any contributor accounts suspected of being compromised or misused.

Patch Information

The vendor released a fix in changeset 3666521 for the profile-builder plugin. The patch adds proper sanitization and output escaping on the date shortcode attribute. Site administrators should upgrade all instances to the patched release. Additional technical detail is available in the Wordfence Vulnerability Report.

Workarounds

Disable the format-date shortcode by unchecking it in the plugin's Toolbox Shortcodes settings until the patch can be applied.
Restrict contributor-level account creation and require editorial review of all contributor-submitted content before publishing.
Deploy a web application firewall (WAF) rule that blocks shortcode attributes containing HTML tag characters such as <, >, and script.

bash

# Configuration example: disable the vulnerable shortcode via WP-CLI
wp option patch update wppb_toolbox_shortcodes_settings format-date no

# Verify the current setting
wp option get wppb_toolbox_shortcodes_settings