User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, CVE-2022-0653

CVE, Research URL: CVE-2022-0653
Home page URL: Security reports for User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Application: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Published on: Feb 25, 2022
Research Description: The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
Affected versions: Min -, max 3.6.2.
Status: vulnerable

User Profile Builder &#8211; Beautiful User Registration Forms, User Profiles &amp; User Role Editor, CVE-2022-0653