Product
The User Profile Builder plugin for WordPress is vulnerable to unauthenticated stored XSS in the 'First Name' field when Email Confirmation is enabled, allowing script injection into user profiles.