When successful, the injected script is stored in the application database and subsequently executed in the browser of any user who accesses the injected page, such as administrators or other users viewing profile information. This allows attackers to perform actions on behalf of the victim, steal session cookies, or redirect users to malicious domains, posing a significant risk to site integrity and user data.

Impact

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users' browsers. This can lead to unauthorized account access, session hijacking, and the potential compromise of administrative accounts if an administrator views the profile of an attacker-controlled user. The scope is limited to WordPress installations utilizing the Profile Builder plugin with specific configuration settings enabled.

Recommendation

Prioritize the immediate update of the User Profile Builder plugin to the latest patched version available. Ensure that all security plugins are configured to monitor for suspicious input in registration forms. Review user management logs to identify any accounts created with anomalous first name patterns or script characters.

• Update the User Profile Builder plugin to the version containing the security fix for CVE-2026-100186 immediately.
• Disable the 'Email Confirmation' feature in the Profile Builder settings as a temporary mitigation until the plugin can be patched.
• Monitor web application logs for HTTP POST requests to registration endpoints containing script tags, JavaScript events, or HTML entities.