CVE-2026-111948

The User Profile Builder WordPress plugin (versions before 4.0.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to escape the current page URL before outputting it within a JavaScript context on one of its admin pages. This vulnerability can be exploited t...

CVE-2026-111948 Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users...