WordPress Plugin Vulnerabilities

Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions

Description

The plugin does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.

Proof of Concept

Affects Plugins

Plugin icon
profile-builder
Fixed in 4.0.1

References

CVE
CVE-2026-111948

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
0xBassia
Submitter
0xBassia
Submitter website
https://github.com/0xBassia
Submitter twitter
MohamedBassia
Verified
Yes
WPVDB ID
c47a205d-3413-4835-a852-05ea8609802a

Timeline

Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)

Other

Published
Title
Published
2024-11-27
Title
Ragic Shortcode < 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-26
Title
All-in-One WP Migration and Backup < 7.98 - Admin+ Stored XSS
Published
2022-08-31
Title
add2fav <= 1.0 - Admin+ Stored Cross-Site Scripting
Published
2024-07-10
Title
CodePen Embedded Pens Shortcode < 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-05-22
Title
Butcher < 2.54 - Reflected Cross-Site Scripting