CVE-2026-93656

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via a nonce-free GET request to /wp-admin/profile.php, requiring no profile-form submission; a Subscriber can plant the malicious attachment URL, which then executes when an administrator opens that user's Edit User screen.

• CWE-79

• https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L43
• https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L67
• https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/avatar/avatar.php#L75
• https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/fields-functions.php#L30
• https://plugins.trac.wordpress.org/browser/profile-builder/tags/4.0.2/front-end/default-fields/upload/upload_helper_functions.php#L286
• https://plugins.trac.wordpress.org/changeset/3708665/profile-builder
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4d4991ff-903a-410a-b472-1a5f76a32940?source=cve

Published

Sep 25, 2026

Last Modified

Sep 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9365A vulnerability has been found in Ettercap up to 0.8.3. The …5.6
• CVE-2026-93650A vulnerability was determined in Saleor up to 3.20.118/3.21…3.7
• CVE-2026-93652Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes h…7.5
• CVE-2026-93653A denial of service flaw was found in Poppler's Splash backe…5.5
• CVE-2026-93654The Premium Packages – Sell Digital Products Securely plugin…7.2
• CVE-2026-93655The Booking Calendar plugin for WordPress is vulnerable to R…6.1
• CVE-2026-93657hickory-resolver versions before 0.26.2 fail to propagate bo…7.5
• CVE-2026-93658uutils coreutils versions before 0.10.0 apply setuid or setg…7
• CVE-2026-93659Concrete CMS Community Store before 2.7.8 renders customer-s…8.7
• CVE-2026-9366A vulnerability was found in NousResearch hermes-agent 2026.…7.3
• CVE-2026-93660SQLBot through 1.10.1 fails to verify dashboard ownership in…6.5
• CVE-2026-93661The Events Manager WordPress plugin before 7.4.5 does not s…2.7