The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gdpr_communication_preferences[]’ parameter in all versions up to and including 3.14.3 due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can inject arbitrary web scripts that execute when a user accesses the affected page. This vulnerability is only exploitable when the GDPR Communication Preferences module is enabled and at least one field has been added to the edit profile form.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.4 | CVE-2025-8896 |
Exploitation
To exploit this vulnerability, an attacker with Subscriber-level access must enable the GDPR Communication Preferences module and add at least one field to the edit profile form. They can then inject malicious scripts into the ‘gdpr_communication_preferences[]’ parameter, which will execute when other users access the affected pages.
Affected Products
- User Profile Builder plugin for WordPress (versions up to and including 3.14.3)
Mitigation
To mitigate this vulnerability, users should update the User Profile Builder plugin to the latest version where the issue has been resolved. Additionally, it is recommended to review and sanitize all user inputs and outputs to prevent similar vulnerabilities.