ProfileGrid – User Profiles, Groups and Communities

Vulnerabilities

• CVE-2024-30490unauthenticated≤ 5.7.8

  WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability

  Critical 9.8

• CVE-2026-57759unauthenticated · needs a click≤ 6.0.0.2

  WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability

  High 8.8

• CVE-2024-31362unauthenticated · needs a click≤ 5.7.8

  WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability

  High 8.8

• CVE-2023-47644unauthenticated · needs a click≤ 5.6.6

  WordPress ProfileGrid Plugin <= 5.6.6 is vulnerable to Cross Site Request Forgery (CSRF)

  High 8.8

• CVE-2025-0724subscriber+≤ 5.9.4.5

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection

  High 8.8

• CVE-2025-26999login required≤ 5.9.4.3

  WordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerability

  High 8.8

• CVE-2024-37453login required≤ 5.8.7

  WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control vulnerability

  High 8.8

• CVE-2024-6411subscriber+≤ 5.8.9

  ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation

  High 8.8

• CVE-2024-32774login required≤ 5.8.2

  WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability

  High 8.8

• CVE-2024-32808login required≤ 5.7.9

  WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability

  High 8.8

• CVE-2024-32772login required≤ 5.7.9

  WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability

  High 8.8

• CVE-2024-30491login required≤ 5.7.8

  WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability

  High 8.8

• CVE-2022-36352login required≤ 5.0.3

  WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control

  High 8.8

• CVE-2023-3714login required≤ 5.5.2

  ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation

  High 8.8

• CVE-2023-3713subscriber+≤ 5.5.1

  ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update

  High 8.8

• CVE-2022-41791subscriber+≤ 5.1.6

  WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability

  High 8.8

• CVE-2019-15873login required

  The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.

  High 8.8

• CVE-2024-30241contributor+≤ 5.7.1

  WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection vulnerability

  High 8.8

• CVE-2025-49033login required≤ 5.9.5.3

  WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability

  High 8.5

• CVE-2025-49876login required≤ 5.9.5.2

  WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerability

  High 8.5

• CVE-2025-47478login required≤ 5.9.5.0

  WordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection Vulnerability

  High 8.5

• CVE-2025-39586login required≤ 5.9.4.8

  WordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection Vulnerability

  High 8.5

• CVE-2024-10900subscriber+≤ 5.9.3.6

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion

  High 8.1

• CVE-2026-57697unauthenticated≤ 5.9.9.6

  WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability

  High 7.5

• CVE-2025-4957unauthenticated · needs a click≤ 5.9.5.7

  WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2026-4609subscriber+≤ 5.9.8.4

  ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining

  High 7.1

• CVE-2024-31291login required≤ 5.7.6

  WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability

  High 7.1

• CVE-2024-49273unauthenticated · needs a click≤ 5.9.3

  WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability

  Medium 6.5

• CVE-2026-4608subscriber+≤ 5.9.8.4

  ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter

  Medium 6.5

• CVE-2026-25417login required≤ 5.9.8.1

  WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2025-0723subscriber+≤ 5.9.4.7

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection

  Medium 6.5

• CVE-2024-30513login required≤ 5.7.2

  WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability

  Medium 6.5

• CVE-2026-4610subscriber+≤ 5.9.9.2

  ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content

  Medium 6.4

• CVE-2023-52117login required≤ 5.6.6

  WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerability

  Medium 6.3

• CVE-2025-6977unauthenticated · needs a click≤ 5.9.5.4

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function

  Medium 6.1

• CVE-2024-13741subscriber+≤ 5.9.4.2

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery

  Medium 5.4

• CVE-2022-0233login required≤ 4.7.4

  ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 Authenticated Stored Cross-Site Scripting

  Medium 5.4

• CVE-2024-8861contributor+≤ 5.9.3.2

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Medium 5.4

• CVE-2026-62061unauthenticated≤ 6.0.0.2

  WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability

  Medium 5.3

• CVE-2026-1271subscriber+≤ 5.9.7.2

  ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification

  Medium 5.3

• CVE-2025-49877login required≤ 5.9.5.2

  WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability

  Medium 4.9

• CVE-2023-3404admin≤ 5.5.0

  ProfileGrid <= 5.5.0 - Hardcoded Encryption Key

  Medium 4.9

• CVE-2026-2494unauthenticated · needs a click≤ 5.9.8.2

  ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial

  Medium 4.3

• CVE-2026-4607subscriber+≤ 5.9.8.4

  ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification

  Medium 4.3

• CVE-2026-2488subscriber+≤ 5.9.8.1

  ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion

  Medium 4.3

• CVE-2025-13416subscriber+≤ 5.9.7.2

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension

  Medium 4.3

• CVE-2025-52719login required≤ 5.9.5.2

  WordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability

  Medium 4.3

• CVE-2025-48079login required≤ 5.9.5.1

  WordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control Vulnerability

  Medium 4.3

• CVE-2025-1408subscriber+≤ 5.9.4.4

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management

  Medium 4.3

• CVE-2024-13740subscriber+≤ 5.9.4.2

  ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure

  Medium 4.3

• CVE-2024-6410subscriber+≤ 5.8.9

  ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference

  Medium 4.3

• CVE-2024-5453subscriber+≤ 5.8.6

  ProfileGrid <= 5.8.6 - Missing Authorization

  Medium 4.3

• CVE-2024-3606subscriber+≤ 5.8.3

  ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization

  Medium 4.3

• CVE-2023-3403subscriber+≤ 5.5.1

  ProfileGrid <= 5.5.1 - Missing Authorization to User Import

  Medium 4.3