CVE-2026-76546: User Profile Builder WordPress XSS Vulnerability

CVE-2026-76546 Overview

CVE-2026-76546 is a Stored Cross-Site Scripting (XSS) vulnerability in the User Profile Builder WordPress plugin versions prior to 4.0.1. The plugin fails to escape output from one of its optional shortcodes. Authenticated users with a role as low as contributor can inject persistent JavaScript payloads. Any user viewing the affected content, including administrators, executes the attacker-controlled script in their browser session. The vulnerable shortcode is not enabled by default, which reduces the exposed attack surface. The weakness is tracked under CWE-79.

Critical Impact
A contributor-level account can achieve stored JavaScript execution in an administrator's browser, enabling session theft, account takeover, and post-authentication actions in the WordPress admin panel.

Affected Products

User Profile Builder WordPress plugin versions before 4.0.1
WordPress sites where the optional vulnerable shortcode is enabled
WordPress installations permitting contributor-role account registration

Discovery Timeline

2026-08-29 - CVE-2026-76546 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-76546

Vulnerability Analysis

The User Profile Builder plugin exposes an optional shortcode that renders user-controlled input without proper output escaping. When a contributor embeds the shortcode with attacker-controlled parameters or content, the plugin outputs the value directly into the rendered page HTML. Browsers then parse the injected markup as executable JavaScript.

Exploitation requires an authenticated account with contributor privileges or higher and requires a victim to view the affected content. Because WordPress administrators frequently review contributor submissions, the delivery path from injection to admin execution is realistic in production environments.

The payload persists in the WordPress database and re-executes on every page load, distinguishing this issue from reflected XSS. Successful exploitation permits session cookie theft, forced administrative actions through CSRF-style requests, plugin installation, and creation of persistent backdoor accounts.

Root Cause

The root cause is missing output escaping in the shortcode handler. The plugin should apply esc_html(), esc_attr(), or wp_kses() filtering appropriate to the output context before echoing user-supplied values. The absence of these WordPress sanitization primitives allows raw HTML and script tags to reach the DOM.

Attack Vector

An authenticated contributor authors a post or profile field containing the vulnerable shortcode with an embedded JavaScript payload. The stored payload executes when any authenticated user, including an administrator, renders the page. The attack requires user interaction from the victim to view the content but no additional privileges beyond the initial contributor account.

For technical details on the shortcode handler and payload construction, refer to the WPScan Vulnerability Detail.

Detection Methods for CVE-2026-76546

Indicators of Compromise

Contributor or subscriber accounts creating posts containing User Profile Builder shortcodes with unusual attribute values
Presence of <script>, onerror=, onload=, or javascript: strings inside wp_posts rows referencing plugin shortcodes
Unexpected administrative actions (new admin accounts, plugin installs) shortly after an admin viewed contributor content
Outbound HTTP requests from admin browser sessions to unfamiliar external hosts carrying WordPress cookies

Detection Strategies

Query the wp_posts table for shortcodes belonging to User Profile Builder combined with HTML event handlers or script tags
Monitor WordPress audit logs for privilege escalations following contributor content review
Inspect rendered page responses for unescaped user input within shortcode-rendered regions

Monitoring Recommendations

Alert on creation of new administrator role users outside change windows
Log and review all plugin and theme installations for correlation with recent admin sessions
Track WordPress REST API and admin-ajax.php traffic for anomalous state-changing calls initiated from admin browser sessions

How to Mitigate CVE-2026-76546

Immediate Actions Required

Update the User Profile Builder plugin to version 4.0.1 or later on all WordPress sites
Audit contributor and author accounts and remove any that are unrecognized or inactive
Review recent posts and user profile content for stored payloads and purge affected entries
Rotate WordPress administrator passwords and invalidate active sessions after remediation

Patch Information

The vendor addressed the flaw in User Profile Builder version 4.0.1 by adding output escaping to the affected shortcode. Refer to the WPScan Vulnerability Detail for advisory tracking and fixed-version confirmation.

Workarounds

Disable the optional vulnerable shortcode if it is not required for site functionality
Restrict contributor-level registration and require editorial review of all contributor submissions before publication
Deploy a Web Application Firewall (WAF) rule to block shortcode payloads containing HTML event handlers or <script> tags
Apply a Content Security Policy (CSP) that disallows inline scripts to reduce the impact of stored XSS

bash

# Update User Profile Builder via WP-CLI
wp plugin update profile-builder --version=4.0.1

# Verify installed version
wp plugin get profile-builder --field=version

# Search stored content for suspicious shortcode payloads
wp db query "SELECT ID, post_author, post_title FROM wp_posts \
  WHERE post_content LIKE '%[wppb-%' \
  AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%');"