WordPress Plugin Vulnerabilities

Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute

Description

The plugin does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

Proof of Concept

Affects Plugins

Plugin icon
profile-builder
Fixed in 4.0.5

References

CVE
CVE-2026-111966

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Jacek Sowiński
Submitter
Jacek Sowiński
Submitter twitter
thedzaku
Verified
Yes
WPVDB ID
26983c21-09d2-491f-b62f-1270b335dfcd

Timeline

Publicly Published
2026-10-21 (about 2 days ago)
Added
2026-10-21 (about 1 day ago)
Last Updated
2026-10-21 (about 1 day ago)

Other

Published
Title
Published
2026-03-20
Title
FuseDesk < 6.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute
Published
2021-03-24
Title
Elementor < 3.4.8 - DOM Cross-Site-Scripting
Published
2023-01-19
Title
Camera slideshow <= 1.4.0.1 - Reflected Cross-Site Scripting
Published
2016-07-13
Title
All in One SEO Pack <= 2.3.7 - Unauthenticated Stored Cross-Site Scripting (XSS)
Published
2020-11-18
Title
Fancy Product Designer < 4.5.1 - Unauthenticated Stored Cross-Site Scripting