CVE-2026-42385: WordPress Profile Builder Pro plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the Profile Builder Pro WordPress plugin, versions 3.15.0 and earlier. The flaw is reachable over the network without any login credentials, but requires a victim to interact with a malicious link or page. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser, enabling session theft, page content manipulation, or redirection to attacker-controlled sites. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress site.

• AuthenticationNot required

  No account or session credential is needed; the attacker can send a malicious payload as an unauthenticated visitor.

• Victim interactionRequired

  A victim must follow a crafted link or visit an attacker-controlled page that triggers the injected script, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or unusual environmental configuration to succeed.

Blast Radius

• An attacker can steal session cookies or authentication tokens from the victim's browser, gaining access to the victim's WordPress account without knowing their password.
• Injected JavaScript can read and exfiltrate any data visible on the page in the victim's browser session, including form inputs and personal profile data.
• The attacker can modify page content in the victim's browser, redirecting them to phishing sites or replacing legitimate UI elements with malicious ones.
• With a scope of Changed (S:C in the CVSS vector), the injected script runs in the context of the WordPress site origin, meaning its reach extends beyond the vulnerable plugin itself to other data and functionality on the same domain.