Police identified the suspect as Radcliffe Franklin Haughton, 45, of Brown Deer. Brookfield Police Chief Dan Tushaus said Haughton's car had been found, but he was still at large.
The shooting happened about 11 a.m. at the Azana Day Spa, a two-story, 9,000-square-foot building across from a major shopping mall in a middle- to upper-class community west of Milwaukee.
An improved explosive device was found at the spa, and a bomb squad was investigating, Tushaus said. Spokesmen for the FBI and Bureau of Alcohol, Tobacco, Firearms and Explosives said their agencies also had agents participating in the investigation.
The mall, a country club adjacent to the spa, a nearby hospital and other buildings were locked down as police searched for Haughton, local media reported.
Tushaus described the situation as "fluid and ongoing," saying officers were initially focused on reaching and helping the victims.
Online court records showed a temporary restraining order was issued against Haughton in Milwaukee County Circuit Court on Oct. 8 because of a domestic abuse complaint.
Beth Strohbusch, a spokeswoman for Froedtert Memorial Hospital — the hospital that was locked down — said four shooting victims were taken there, none in critical condition.
It was the second mass shooting in Wisconsin this year. Wade Michael Page, a 40-year-old Army veteran and white supremacist, killed six people and injured three others before fatally shooting himself Aug. 5 at a Sikh temple south of Milwaukee.
The shooting at the mall took place less than a mile from where seven people were killed and four wounded on March 12, 2005, when a gunman opened fire at a Living Church of God service held at a hotel.