CVE-2025-13054

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13054", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-12T10:23:03.370Z", "datePublished": "2025-11-19T05:45:12.261Z", "dateUpdated": "2026-04-08T16:46:29.029Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:29.029Z"}, "affected": [{"vendor": "cozmoslabs", "product": "User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.14.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3830ae19-cafc-40db-afde-2424cae23031?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397155/profile-builder"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-10-30T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-12T10:51:23.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-18T16:29:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T20:21:37.835169Z", "id": "CVE-2025-13054", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T20:21:51.179Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13054", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T20:21:37.835169Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T20:21:46.835Z"}}], "cna": {"title": "User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "cozmoslabs", "product": "User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.14.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-30T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-11-12T10:51:23.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-18T16:29:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3830ae19-cafc-40db-afde-2424cae23031?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3397155/profile-builder"}], "descriptions": [{"lang": "en", "value": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:46:29.029Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13054", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:46:29.029Z", "dateReserved": "2025-11-12T10:23:03.370Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-19T05:45:12.261Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor", "vendor": "cozmoslabs", "versions": [{"lessThanOrEqual": "3.14.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin User Profile Builder - Beautiful User Registration Forms, User Profiles & User Role Editor para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del shortcode 'wppb-embed' del plugin en todas las versiones hasta la 3.14.8, inclusive, debido a una sanitizaci\u00f3n de entrada y escape de salida insuficientes en atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13054", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13054", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T20:21:37.835169Z", "version": "2.0.3"}}]}, "published": "2025-11-19T06:15:47.370", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3397155/profile-builder"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3830ae19-cafc-40db-afde-2424cae23031?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:11:37.774605+00:00", "value": {"mitigation_remediation": ["Upgrade the plugin to version 3.14.9 or later.", "If an upgrade cannot be performed immediately, remove or disable the wppb-embed shortcode in existing content or restrict its use to higher\u2011privileged roles.", "For sites that still rely on the shortcode for public content, replace it with a safer alternative or apply a content\u2011filtering plugin that sanitizes shortcode attributes."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "WordPress sites that run the User Profile Builder \u2013 Beautiful User Registration Forms, User Profiles & User Role Editor plugin by cozmoslabs in versions 3.14.8 or earlier.", "description_and_impact": "The vulnerability arises from insufficient sanitization and escaping of attributes supplied to the wppb-embed shortcode. An authenticated user with contributor-level permissions can embed malicious JavaScript that is persisted in the post content. When any user views a page containing the injected shortcode, the code runs in their browser and can steal data, hijack sessions or deface sites.", "risk_and_exploitability": "The CVSS base score is 6.4, indicating a moderate severity. The EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Because the attacker must be authenticated with at least contributor rights, the attack surface is limited to sites where such privileges exist, but once injected, the payload affects all users who visit the affected page. No network\u2011level exploitation is required; the vector hinges on the plugin\u2019s shortcode processing."}}}}, "created": "2025-11-20T10:30:50.297362+00:00", "updated": "2026-04-21T18:15:36.376794+00:00", "vendors": ["cozmoslabs", "cozmoslabs$PRODUCT$profile_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}