User Profile Builder

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form, allowing an Administrator of a Multisite subsite to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 4.0.5.

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 4.0.5. The narrative names the role described above, while the CVSS vector records high privileges (PR:H); that vector does not establish an Administrator-only requirement.

The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: before 4.0.1.

User Profile Builder before 4.0.1 does not properly restrict its front-end file-upload feature. An unauthenticated visitor can gain capabilities reserved for privileged users, list the media library, and modify unpublished posts, pages, and media items owned by other accounts.

User Profile Builder before 4.0.1 deserializes configuration-import data without validating its type. An Administrator can inject a PHP object when the optional free import add-on is enabled. The plugin does not contain a usable gadget chain itself, so further impact requires a suitable gadget in another installed component.

User Profile Builder before 4.0.1 fails to escape output from an optional shortcode. When that shortcode is enabled, a Contributor can store script that executes for anyone viewing the affected content, including Administrators; the shortcode is disabled by default.

User Profile Builder before 3.16.4 does not correctly bind its automatic post-registration login to the account that was just created. On sites using a supported but non-default configuration, an unauthenticated visitor can manipulate the registration flow and receive an authenticated session for an arbitrary existing user, including an Administrator. The published.

User Profile Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.