CVE-2026-111966
6.8 MEDIUMPublished 2026-10-23 · Updated 2026-10-23
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2012-20003PoC
- MEDIUMCVE-2012-20004PoC
- MEDIUMCVE-2012-20005PoC
- MEDIUMCVE-2014-125131PoC
- MEDIUMCVE-2014-125132PoC
- MEDIUMCVE-2016-20098PoC
- MEDIUMCVE-2016-20102PoC
- MEDIUMCVE-2017-20288PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.