CVE-2022-0653

Deeper analysis

The Profile Builder plugin for WordPress, which handles user profile management and registration forms, contains a reflected cross-site scripting vulnerability in versions up to and including 3.6.1. The flaw stems from inadequate escaping and sanitization of the site_url parameter within the fallback-page.php file, allowing arbitrary script injection that executes in the context of the affected site when a crafted link is visited.

An unauthenticated attacker can exploit the issue by crafting a malicious URL containing the injected payload and tricking a victim into clicking it. Successful exploitation results in the attacker’s script running in the victim’s browser with the privileges of the site, enabling theft of session tokens, redirection to phishing pages, or other actions limited to the reflected context.

Public references from Wordfence and the WordPress plugin repository document the release of a patched version that addresses the input handling deficiency, with the fix committed via changeset 2655168. Site administrators are advised to update the plugin promptly to a version beyond 3.6.1.

The associated EPSS score rose materially from a low baseline to a peak of 0.2161 before receding to the current value of 0.0565, indicating a period of increased exploitation interest following disclosure.