high7.1
CVE-2026-111948
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pa…
Impact
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
Affected products
| Product | Affected versions |
|---|---|
| User Profile Builder WordPress Plugin | before 4.0.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.