CVE-2026-93656 cozmoslabs CVE debrief

Who should care

WordPress administrators and users with subscriber-level access who use the User Profile Builder plugin should assess their exposure and apply updates. They should also restrict access to the WordPress admin area for users with subscriber-level access and monitor for suspicious activity on WordPress sites.

Why it matters

CVE-2026-93656 allows authenticated attackers with subscriber-level access to inject web scripts that execute when a user accesses an injected page. Defenders should assess exposure, apply updates, and monitor for suspicious activity.

• Defenders should verify if their WordPress installations have the vulnerable plugin version.
• Defenders should restrict access to the WordPress admin area for users with subscriber-level access.
• Defenders should monitor for suspicious activity on WordPress sites with subscriber-level access.

Technical summary

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Avatar Field in all versions up to, and including, 4.0.2. This is due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission. A Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user's Edit User screen.

Defensive priority

Medium priority for WordPress administrators and users with subscriber-level access; assess exposure and apply updates.

Recommended defensive actions

• Assess exposure of WordPress installations with the User Profile Builder plugin version 4.0.2 or earlier.
• Update the User Profile Builder plugin to a version that addresses this vulnerability.
• Monitor for suspicious activity on WordPress sites with subscriber-level access.
• Restrict access to the WordPress admin area for users with subscriber-level access.
• Verify if the vulnerable plugin version is installed on any WordPress sites.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability allows authenticated attackers with subscriber-level access to inject arbitrary web scripts. The issue is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.