https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-23T19:59:47.474751+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-111966 fkie_cve-2026-111966 2026-10-23T19:59:47.477176+00:00

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.

 https://db.gcve.eu/vuln/ghsa-9mx2-qxwc-rp6q GHSA-9mx2-qxwc-rp6q 2026-10-23T19:59:47.477271+00:00

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.