PT-2025-33539 · WordPress · User Profile Builder

Jessie Irelan · Published 2025-08-16 · Updated 2025-08-16 · CVE-2025-8896

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress versions through 3.14.3

Description: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is susceptible to Stored Cross-Site Scripting via the gdpr communication preferences[] parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into pages, which will execute when a user accesses the injected page. This is only exploitable when the GDPR Communication Preferences module is enabled and at least one GDPR Communication Preferences field has been added to the edit profile form.

Recommendations: Update to a version beyond 3.14.3. Disable the GDPR Communication Preferences module. Remove any GDPR Communication Preferences fields from the edit profile form.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-8896

Affected Products

User Profile Builder

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-8896 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1d28e118-07d3-483e-87b8-66ccdb79e879?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1956622255791702296 · Twitter Post
• https://twitter.com/CVEnew/status/1956654777640890850 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3344317%40profile-builder&new=3344317%40profile-builder&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/30186 · Telegram Post
• https://t.me/cveNotify/132571 · Telegram Post