Profile Builder < 4.0.1 – Contributor+ Stored XSS via Format Date Shortcode | CVE 2026-76546

Description

The plugin does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

Proof of Concept

The PoC will be displayed on September 10, 2026, to give users the time to update.

Affects Plugins

profile-builder

Fixed in 4.0.1

References

CVE

CVE-2026-76546

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

6.8 (medium)

Miscellaneous

Original Researcher

Muni Nitish Kumar Yaddala

Submitter

Muni Nitish Kumar Yaddala

Submitter website

https://nitish-yaddala.vercel.app

Verified

Yes

WPVDB ID

2c67d682-3e11-4fcd-9aae-ab7895d5da67

Timeline

Publicly Published

2026-08-27 (about 2 days ago)

Added

2026-08-27 (about 1 day ago)

Last Updated

2026-08-27 (about 1 day ago)

Other

Published

Title

Published

2025-08-01

Title

Image Gallery <= 1.0.0 - Reflected Cross-Site Scripting

Published

2023-09-08

Title

Simple Download Counter < 1.6.1 - Contributor+ Stored XSS

Published

2023-12-19

Title

WooCommerce Menu Extension <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2022-04-26

Title

Gwyn's Imagemap Selector <= 0.3.3 - Reflected Cross-Site Scripting

Published

2025-09-22

Title

Adverts <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting