CVE-2026-76546

The User Profile Builder WordPress plugin prior to version 4.0.1 is vulnerable to a Stored Cross-Site Scripting (XSS) attack caused by unescaped output in the Format Date shortcode . Any user with a role as low as contributor can inject malicious script that executes when any user—including admin...