What’s Vulnerable › Products
metagauss ProfileGrid – User Profiles, Groups and Communities vulnerabilities
66 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.
Check whether your metagauss ProfileGrid – User Profiles, Groups and Communities version is affected
Latest metagauss ProfileGrid – User Profiles, Groups and Communities vulnerabilities
- CVE-2026-103693 — Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection (CVSS 9.0)
- CVE-2026-94663 — WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability (CVSS 8.5)
- CVE-2026-62061 — WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- CVE-2026-16290 — ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group (CVSS 5.3)
- CVE-2026-16289 — ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group (CVSS 4.3)
- CVE-2026-16291 — ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR (CVSS 4.3)
- CVE-2026-12687 — ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID (CVSS 7.5)
- CVE-2026-12690 — ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization (CVSS 3.8)
- CVE-2026-12689 — ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization (CVSS 5.4)
- CVE-2026-12688 — ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery (CVSS 6.5)
- CVE-2026-57697 — WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability (CVSS 7.5)
- CVE-2026-57759 — WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- CVE-2026-12073 — ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite (CVSS 9.8)
- CVE-2026-4610 — ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content (CVSS 6.4)
- CVE-2026-4609 — ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining (CVSS 7.1)
- CVE-2026-4608 — ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter (CVSS 6.5)
- CVE-2026-4607 — ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification (CVSS 4.3)
- CVE-2026-25417 — WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-2494 — ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial (CVSS 4.3)
- CVE-2026-2488 — ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion (CVSS 4.3)
- CVE-2026-1271 — ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification (CVSS 5.3)
- CVE-2025-13416 — ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension (CVSS 4.3)
- CVE-2025-4957 — WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2025-49033 — WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability (CVSS 8.5)
- CVE-2025-49876 — WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerability (CVSS 8.5)