Security Alert Summary
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in the Avatar field in all versions up to and including 4.0.2. Authenticated users with subscriber-level access and above can inject script-bearing content via a nonce-free GET request to /wp-admin/profile.php, which will execute when an administrator or other privileged user opens the affected user's Edit User screen.
CVE Details
- CVE ID: CVE-2026-93656
- Affected component: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (plugin)
- Affected versions: All versions up to and including 4.0.2
- Published: September 25, 2026 at 08:16:41 AM UTC
- Last modified: September 25, 2026 at 02:17:23 PM UTC
- CVSS v3.1 base score: 6.4
- CVSS v3.1 severity: MEDIUM
- CVSS vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: Authentication required (attacker must be an authenticated user). Privileges required: Low (e.g., Subscriber-level). User interaction: None.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Scope: Changed (vulnerability can affect resources beyond the vulnerable component)
- CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This is a stored cross-site scripting (XSS) vulnerability in the plugins Avatar field. The issue is caused by insufficient input sanitization and missing output escaping for an attachment URL used as an avatar. An authenticated attacker with subscriber-level access or higher can supply a malicious attachment URL via a nonce-free GET request to /wp-admin/profile.php without submitting a profile form. Because the request path lacks the expected nonce or other server-side checks, the malicious value is stored and later rendered in pages such as the Edit User screen.
The vulnerability is exploitable when a privileged user opens the injected user's Edit User screen; the stored script then executes in the context of the privileged user's browser. References indicate the issue is present in the plugin files handling the avatar field and upload helper routines (see references for file locations and lines). The root cause is insufficient validation and escaping of user-supplied avatar data combined with the absence of a nonce check on the request that stores the value.
How This Could Impact Your Website
Consider a WordPress site with multiple users: a site owner (administrator), internal staff (editors or authors), and an external contractor or contributor who has subscriber-level access for comment or profile purposes. A subscriber could add a specially crafted avatar attachment URL that contains script. When an administrator or editor opens that user's Edit User screen, the stored script can execute in their browser session.
Practical consequences include exposure of data accessible in the administrator's browser context (for example, visible profile details or session-accessible information) and an increased risk of targeted phishing or social engineering against privileged users. Attackers might also use executed scripts to perform actions available to the privileged user in their browser, consistent with the low confidentiality and integrity impacts noted in the CVSS data, but this does not imply automatic full site takeover.
If you're unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and permissions, especially for contributor and subscriber accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and admin screens for unusual behavior or unexpected user data.
If you'd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L43
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L67
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L75
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/fields-functions.php#L30
- https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/upload/upload_helper_functions.php#L286
- https://plugins.trac.wordpress.org/changeset/3708665/profile-builder
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4991ff-903a-410a-b472-1a5f76a32940?source=cve
