CVE-2026-76546

UNKNOWN 0.0

Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The User Profile Builder WordPress plugin before 4.0.1 does not escape the output of one of its optional shortcodes, allowing users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against any user viewing the affected content, including administrators. The shortcode is not enabled by default.

Vendor	unknown
Product	user profile builder
Published	Aug 29, 2026

Stay Ahead of the Next One

Get instant alerts for unknown user profile builder

Be the first to know when new unknown vulnerabilities affecting unknown user profile builder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / User Profile Builder

3.3.4 < 4.0.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/2c67d682-3e11-4fcd-9aae-ab7895d5da67/

Credits

Muni Nitish Kumar Yaddala WPScan