CVE-2026-100186

7.2High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can execute arbitrary web scripts in victim browsers by submitting a malicious First Name during registration. Exploitation requires the Email Confirmation feature to be enabled.

Root cause

The First Name field lacks sufficient input sanitization and output escaping when processed by the email confirmation module.

Affected systems

User Profile Builder (WordPress plugin) all versions up to and including 4.0.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade to a version newer than 4.0.3 once available. As an interim workaround, disable the Email Confirmation feature in Profile Builder settings.

shell

$ wp plugin update profile-builder

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Email Confirmation feature is enabled in Profile Builder.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-100186