Medium severity6.1NVD Advisory· Published Feb 24, 2022· Updated Jun 17, 2026

CVE-2022-0653

Description

The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.

Affected products

WordPress/Profile Builderllm-fuzzy
Range: <=3.6.1
Package: https://wordpress.org/plugins/profile-builder
Cozmoslabs/Profile Builder – User Profile & User Registration Formsv5
Range: 3.6.1

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvdPatchThird Party Advisory
www.wordfence.com/blog/2022/02/reflected-cross-site-scripting-vulnerability-patched-in-wordpress-profile-builder-plugin/nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000