{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/user-profile-builder--4.0.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cozmoslabs:profile_builder:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-100186"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["User Profile Builder (\u003c= 4.0.3)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe User Profile Builder plugin for WordPress, specifically versions up to and including 4.0.3, contains a high-severity Stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2026-100186. The flaw stems from inadequate input sanitization and output escaping within the 'First Name' user registration field. An unauthenticated attacker can exploit this by injecting malicious JavaScript into the first name field during the registration process, provided that the 'Email Confirmation' feature is currently enabled within the plugin's settings.\u003c/p\u003e\n\u003cp\u003eWhen successful, the injected script is stored in the application database and subsequently executed in the browser of any user who accesses the injected page, such as administrators or other users viewing profile information. This allows attackers to perform actions on behalf of the victim, steal session cookies, or redirect users to malicious domains, posing a significant risk to site integrity and user data.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of other users' browsers. This can lead to unauthorized account access, session hijacking, and the potential compromise of administrative accounts if an administrator views the profile of an attacker-controlled user. The scope is limited to WordPress installations utilizing the Profile Builder plugin with specific configuration settings enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the immediate update of the User Profile Builder plugin to the latest patched version available. Ensure that all security plugins are configured to monitor for suspicious input in registration forms. Review user management logs to identify any accounts created with anomalous first name patterns or script characters.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the User Profile Builder plugin to the version containing the security fix for CVE-2026-100186 immediately.\u003c/li\u003e\n\u003cli\u003eDisable the 'Email Confirmation' feature in the Profile Builder settings as a temporary mitigation until the plugin can be patched.\u003c/li\u003e\n\u003cli\u003eMonitor web application logs for HTTP POST requests to registration endpoints containing script tags, JavaScript events, or HTML entities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:26:09Z","date_published":"2026-10-16T06:26:09Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-100186-xss/","summary":"The User Profile Builder plugin for WordPress is vulnerable to unauthenticated stored XSS in the 'First Name' field when Email Confirmation is enabled, allowing script injection into user profiles.","title":"Stored Cross-Site Scripting in User Profile Builder Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-100186-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - User Profile Builder (\u003c= 4.0.3)","version":"https://jsonfeed.org/version/1.1"}