PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111948 User Profile Builder CVE debrief

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users. This vulnerability poses a risk to WordPress installations with high-privilege users, requiring defenders to assess exposure and prioritize updates. The CVE record and source item provide limited information about the vulnerability, but indicate that the User Profile Builder plugin is affected by a Reflected Cross-Site Scripting vulnerability. Defenders should verify and update the plugin to version 4.0.1 or later. The vulnerability has a high impact

Vendor
User Profile Builder
Product
User Profile Builder
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

Defenders responsible for WordPress installations using the User Profile Builder plugin, especially those with high-privilege users, should assess exposure and prioritize updating the plugin.

Why it matters

The CVE-2026-111948 vulnerability in the User Profile Builder plugin poses a risk to WordPress installations with high-privilege users, requiring defenders to assess exposure and prioritize updates.

  • High-privilege users may be vulnerable to Reflected Cross-Site Scripting attacks
  • Successful exploitation could lead to unauthorized actions or data access
  • Defenders must verify and update the User Profile Builder plugin to prevent exploitation
  • Remediation priority is high due to the potential for XSS attacks

Technical summary

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users. The vulnerability is caused by a lack of proper input validation and sanitization of the current page URL. This allows an attacker to inject malicious JavaScript code, potentially leading to unauthorized actions or data access. Defenders should prioritize verifying and updating the User Profile Builder plugin to version 4.0.1 or

Defensive priority

Defenders should prioritize verifying and updating the User Profile Builder plugin to version 4.0.1 or later, and ensure that all high-privilege users are aware of the potential XSS vulnerability.

Recommended defensive actions

  • Verify and update the User Profile Builder plugin to version 4.0.1 or later
  • Ensure that all high-privilege users are aware of the potential XSS vulnerability
  • Monitor admin pages for suspicious activity

Evidence notes

The CVE record and source item provide limited information about the vulnerability, but indicate that the User Profile Builder plugin is affected by a Reflected Cross-Site Scripting vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111948 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111948

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111948 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111948

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.