Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 56

Export CSV
CVE-2026-94663

WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress-extensions
Products
Profilegrid Profilegrid
CVE-2026-62061

WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.0.0.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress-extensions
Products
Profilegrid Profilegrid
CVE-2026-57759

WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Profilegrid Wordpress
CVE-2026-57697

WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid : from n/a through <= 5.9.9.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Profilegrid Wordpress
CVE-2026-12073

ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to change email address of user account with ID=1 (usually an administrator), and leverage that to reset the user's password and gain access to their account.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Profilegrid – User Profiles, Groups And Communities Wordpress
CVE-2026-4610

ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Profilegrid – User Profiles, Groups And Communities Wordpress
CVE-2024-13740

ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pm_messenger_show_messages function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read private conversations of other users.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2026-4609

ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up to, and including, 5.9.8.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add themselves or any registered user to any ProfileGrid group, including closed and paid groups, bypassing all authorization and payment gates.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Profilegrid – User Profiles, Groups And Communities Wordpress
CVE-2026-4608

ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to, and including, 5.9.8.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Profilegrid – User Profiles, Groups And Communities Wordpress
CVE-2026-4607

ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action via the pm_set_group_order, pm_set_group_items, and pm_set_field_order AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify site-wide ProfileGrid group settings including group menu order, group list order, group icon display, and field ordering.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss Wordpress
Products
Profilegrid – User Profiles, Groups And Communities Wordpress
CVE-2024-31362

WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2024-31291

WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2024-30490

WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

CVSS 3.1 · 9.3 Critical EPSS 2.2% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2024-30241

WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.1.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2024-32808

WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2024-32772

WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2024-30513

WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2024-30491

WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

CVSS 3.1 · 8.5 High EPSS 32.0% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2023-47644

WordPress ProfileGrid Plugin <= 5.6.6 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.6.6.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid
CVE-2022-41791

WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Metagauss
Products
Profilegrid