CVE-2025-4671

Vulnerability

Overview

The Profile Builder plugin for WordPress, in all versions up to and including 3.13.8, contains a stored cross-site scripting (XSS) vulnerability in its user_meta and compare shortcodes. The root cause is insufficient input sanitization and output escaping on user-supplied attributes within these shortcodes [1]. This allows authenticated attackers, who possess at least contributor-level access, to inject arbitrary web scripts into pages that are later served to other users.

Attack

Vector and Exploitation

Exploitation requires an attacker to have contributor-level access or higher to a WordPress site running the vulnerable plugin. The attacker can create or edit a post or page and utilize the vulnerable shortcodes (user_meta or compare) with crafted attribute values containing malicious JavaScript. Because the plugin fails to properly sanitize these inputs and escape outputs before rendering, the injected script is stored in the database and will execute in the browsers of visitors who view the affected page [1]. No additional user interaction beyond visiting the page is required for the script to run.

Impact

A successful attack leads to persistent execution of attacker-controlled JavaScript in the context of the victim's browser session. Depending on the privileges of the visiting user, this can result in a range of malicious activities, including session hijacking, theft of authentication cookies or sensitive data, defacement of the site, or forced redirection to malicious sites. Because the payload is stored, it can affect multiple visitors over time, amplifying the impact compared to reflected XSS [1].

Mitigation

The vendor has released an updated version of the plugin to address this vulnerability. Users are strongly advised to update the Profile Builder plugin to the latest available version (3.13.9 or higher) immediately. For sites where an immediate update is not possible, removing or restricting contributor and author roles from using the vulnerable shortcodes can serve as a temporary workaround. However, updating is the most complete and recommended solution [1].