Input validation vulnerability in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor 3.13.8

The Profile Builder plugin for WordPress has a security issue called Stored Cross-Site Scripting. This means that a hacker can add harmful code to the plugin’s user_meta and compare shortcodes. This can happen in all versions up to 3.13.8 because the plugin does not properly clean or protect user input. If a hacker with contributor-level access or higher takes advantage of this, they can insert their own code onto pages and it will run when someone views that page.