CVE-2026-111948
CVE-2026-111948 · Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
CVSS 7.1 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
user profile builder
- Versions
- ≥ 0, < 4.0.1: Affected (semver)
Update to 4.0.1