Stored Cross-Site Scripting in User Profile Builder Plugin for WordPress

The User Profile Builder plugin for WordPress (all versions up to and including 3.15.7) contains a critical vulnerability regarding its handling of the 'Biographical Info' meta field. Due to inadequate input sanitization and output escaping, an attacker can inject arbitrary JavaScript code into user profile metadata. This stored XSS vulnerability allows unauthenticated attackers to trigger script execution in the browsers of users viewing the compromised profile, potentially leading to unauthorized actions, session hijacking, or credential theft if an administrator views the profile. Defenders should prioritize updating the plugin to the version containing the fix to prevent script injection in the WordPress administrative or front-end interface.

Impact

Successful exploitation allows unauthenticated attackers to execute malicious scripts in the context of other users' browsers. This can lead to account takeover, unauthorized administrative actions, or defacement. Given the plugin's purpose of managing user registration and profiles, the potential for high-privilege targeting, such as administrative sessions, is significant.

Recommendation

• Update the User Profile Builder plugin to the latest version immediately to ensure proper sanitization of user profile fields.
• Review existing user profile metadata for anomalous content, specifically looking for script tags or event handlers within the 'Biographical Info' field.
• Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources, which mitigates the impact of XSS vulnerabilities.