CVE-2025-6977

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6977", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-01T15:44:06.247Z", "datePublished": "2025-07-16T04:24:02.528Z", "dateUpdated": "2026-04-08T17:15:14.192Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:14.192Z"}, "affected": [{"vendor": "metagauss", "product": "ProfileGrid \u2013 User Profiles, Groups and Communities", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.9.5.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018pm_get_messenger_notification\u2019 function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a logged-in user into performing an action such as clicking on a link."}], "title": "ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/addf264e-e23c-4bb6-a898-0fbb4ec28189?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1322"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1329"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1330"}, {"url": "https://plugins.trac.wordpress.org/changeset/3324676/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Billones"}], "timeline": [{"time": "2025-07-15T16:14:28.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-18T14:45:44.685435Z", "id": "CVE-2025-6977", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T14:45:52.322Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6977", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-18T14:45:44.685435Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-18T14:45:48.404Z"}}], "cna": {"title": "ProfileGrid \u2013 User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function", "credits": [{"lang": "en", "type": "finder", "value": "Kenneth Billones"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "metagauss", "product": "ProfileGrid \u2013 User Profiles, Groups and Communities", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.9.5.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-15T16:14:28.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/addf264e-e23c-4bb6-a898-0fbb4ec28189?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1322"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1329"}, {"url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1330"}, {"url": "https://plugins.trac.wordpress.org/changeset/3324676/"}], "descriptions": [{"lang": "en", "value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018pm_get_messenger_notification\u2019 function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a logged-in user into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:15:14.192Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6977", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:15:14.192Z", "dateReserved": "2025-07-01T15:44:06.247Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-16T04:24:02.528Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ProfileGrid \u2013 User Profiles, Groups and Communities", "vendor": "metagauss", "versions": [{"lessThanOrEqual": "5.9.5.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7BBD9B99-4807-418D-9F81-2E38F5B3190E", "versionEndExcluding": "5.9.5.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018pm_get_messenger_notification\u2019 function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a logged-in user into performing an action such as clicking on a link."}, {"lang": "es", "value": "El complemento ProfileGrid \u2013 User Profiles, Groups and Communities para WordPress es vulnerable a ataques de Cross-Site Scripting Reflejado a trav\u00e9s de la funci\u00f3n 'pm_get_messenger_notification' en todas las versiones hasta la 5.9.5.4 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes no autenticados inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario conectado para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-6977", "lastModified": "2026-06-17T10:02:58.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6977", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-18T14:45:44.685435Z", "version": "2.0.3"}}]}, "published": "2025-07-16T05:15:35.223", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1322"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1329"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php#L1330"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3324676/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/addf264e-e23c-4bb6-a898-0fbb4ec28189?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T20:17:42.731333+00:00", "value": {"mitigation_remediation": ["Upgrade the ProfileGrid plugin to the latest available release (5.9.5.5 or newer).", "If an update is unavailable, override or replace the pm_get_messenger_notification function with a version that sanitizes output using wp_kses or similar escaping functions.", "Implement a security\u2011focused WordPress plugin or host\u2011level filter to detect and block XSS payloads, and configure alerts for suspicious link clicks."], "summary": {"action": "Apply Patch", "impact": "Reflected XSS"}, "threat_synthesis": {"affected_systems": "All installations of the metagauss ProfileGrid \u2013 User Profiles, Groups and Communities plugin for WordPress version 5.9.5.4 or earlier are affected. The issue exists across all WordPress sites that support this plugin version.", "description_and_impact": "The vulnerability resides in the pm_get_messenger_notification function of the ProfileGrid plugin for WordPress. User input is not properly sanitized or escaped before being reflected back to the browser. This flaw, classified as CWE\u201179, allows an unauthenticated attacker to embed malicious scripts in a crafted link. When a logged\u2011in user follows that link, the script runs in the context of the victim\u2019s account, enabling session hijacking, data theft, or defacement.", "risk_and_exploitability": "The CVSS score of 6.1 indicates significant impact with medium exploitability. The EPSS score is below 1\u202f%, implying that while the vulnerability exists, it is considered a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can gain access without authentication and must solely rely on persuading a logged\u2011in user to click a malicious link, which is a feasible social\u2011engineering scenario on most public sites."}}}}, "created": "2026-04-20T20:30:16.065798+00:00", "updated": "2026-04-20T20:30:16.065808+00:00", "vendors": []}