What’s Vulnerable › Vulnerabilities

CVE-2019-15873

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-03 · updated 2026-06-17
• Weakness: CWE-94

Description

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.

Affected products

• metagauss ProfileGrid – User Profiles, Groups and Communities: before 2.8.6 — fixed in 2.8.6

How to fix

Upgrade to a fixed version: metagauss ProfileGrid – User Profiles, Groups and Communities 2.8.6. Check the vendor advisory for mitigations.

References

• https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/#developers
• https://wpvulndb.com/vulnerabilities/9086
• https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/#developers
• https://wpvulndb.com/vulnerabilities/9086

Get alerted when CVE-2019-15873 or the next vulnerability affects your stack