Stored XSS in User Profile Builder WordPress Plugin

The User Profile Builder plugin for WordPress (versions 4.0.2 and earlier) contains a critical stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-95866. The flaw exists within the avatar upload functionality, specifically inside the wppb_save_avatar_value() function. Attackers can leverage a zero-length multipart file branch to bypass existing attachment ID validation routines (wppb_save_attachment_id() and wppb_verify_attachment_id()). By injecting arbitrary script payloads into the avatar field, the data is saved directly into user meta. When an administrator subsequently views the compromised user profile, the payload is rendered by the wppb_default_fields_make_upload_button() function without proper output escaping, leading to script execution within the administrator's browser session. This vulnerability poses a significant risk to WordPress site integrity, as it allows attackers to perform unauthorized actions on behalf of administrators.

Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser session. This can result in unauthorized administrative actions, account takeover, or the injection of malicious content into the site. The vulnerability affects all users of the User Profile Builder plugin version 4.0.2 and below.

Recommendation

Prioritize the update of the User Profile Builder plugin to the latest secure version addressing CVE-2026-95866. If an immediate update is not feasible, restrict access to user registration or avatar upload forms via web application firewall rules. Detection teams should monitor web server logs for suspicious POST requests targeting avatar upload endpoints, specifically looking for anomalous content in file upload parameters.