ProfileGrid – User Profiles, Groups and Communities

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   ProfileGrid – User Profiles, Groups and Communities

Information

Software Type Plugin
Software Slug profilegrid-user-profiles-groups-and-communities (view on wordpress.org)
Software Status Active
Software Author metagauss
Software Website profilegrid.co
Software Downloads 1,158,618
Software Active Installs 5,000
Software Record Last Updated July 19, 2026

Showing 1-20 of 55 Vulnerabilities

Submit a Vulnerability
ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset
9.8
CVE-2026-57697
Jul 8, 2026
Researcher: Jakub Herman
ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.8 - Cross-Site Request Forgery
4.3
CVE-2026-57759
Jul 2, 2026
Researcher: dodoh4t
ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite
9.8
CVE-2026-12073
Jun 29, 2026
Researcher: Ivan Kuzymchak
ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
6.4
CVE-2026-4610
Jun 22, 2026
Researcher: Jonah Burgess (CryptoCat)
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining
7.1
CVE-2026-4609
May 12, 2026
Researcher: Jonah Burgess (CryptoCat)
ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
6.5
CVE-2026-4608
May 12, 2026
Researcher: Jonah Burgess (CryptoCat)
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification
4.3
CVE-2026-4607
May 12, 2026
Researcher: Chawabhon Netisingha (JNX03)
ProfileGrid – User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-25417
Mar 23, 2026
Researcher: daroo
ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
4.3
CVE-2026-2488
Mar 6, 2026
Researchers: Sergej Ljubojevic, Boris Bogosavac
ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial
4.3
CVE-2026-2494
Mar 6, 2026
Researchers: Sergej Ljubojevic, Boris Bogosavac
ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification
5.3
CVE-2026-1271
Feb 4, 2026
Researcher: iwd - Prysm Sec
ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension
4.3
CVE-2025-13416
Feb 4, 2026
Researcher: Athiwat Tiprasaharn (Jitlada)
ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.7 - Reflected Cross-Site Scripting
6.1
CVE-2025-4957
Sep 1, 2025
Researcher: Mohammed Ahmed Abd ElNabi (canitey)
ProfileGrid <= 5.9.5.3 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-49033
Jul 24, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function
6.1
CVE-2025-6977
Jul 15, 2025
Researcher: Kenneth Billones
ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-49876
Jul 10, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
CVE-2025-49877
Jun 12, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
ProfileGrid <= 5.9.5.1 - Missing Authorization
4.3
CVE-2025-48079
May 16, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
ProfileGrid <= 5.9.5.0 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-47478
May 12, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
ProfileGrid <= 5.9.4.8 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2025-39586
Apr 17, 2025
Researcher: Trương Hữu Phúc (truonghuuphuc)
Title Status CVE ID CVSS Researchers Date
ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset Patched CVE-2026-57697 9.8 Jakub Herman July 8, 2026
ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.8 - Cross-Site Request Forgery Unpatched CVE-2026-57759 4.3 dodoh4t July 2, 2026
ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite Patched CVE-2026-12073 9.8 Ivan Kuzymchak June 29, 2026
ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content Patched CVE-2026-4610 6.4 Jonah Burgess (CryptoCat) June 22, 2026
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining Patched CVE-2026-4609 7.1 Jonah Burgess (CryptoCat) May 12, 2026
ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter Patched CVE-2026-4608 6.5 Jonah Burgess (CryptoCat) May 12, 2026
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification Patched CVE-2026-4607 4.3 Chawabhon Netisingha (JNX03) May 12, 2026
ProfileGrid – User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-25417 6.4 daroo March 23, 2026
ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion Patched CVE-2026-2488 4.3 Sergej Ljubojevic, Boris Bogosavac March 6, 2026
ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial Patched CVE-2026-2494 4.3 Sergej Ljubojevic, Boris Bogosavac March 6, 2026
ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification Patched CVE-2026-1271 5.3 iwd - Prysm Sec February 4, 2026
ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension Patched CVE-2025-13416 4.3 Athiwat Tiprasaharn (Jitlada) February 4, 2026
ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.7 - Reflected Cross-Site Scripting Patched CVE-2025-4957 6.1 Mohammed Ahmed Abd ElNabi (canitey) September 1, 2025
ProfileGrid <= 5.9.5.3 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-49033 6.5 Trương Hữu Phúc (truonghuuphuc) July 24, 2025
ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function Patched CVE-2025-6977 6.1 Kenneth Billones July 15, 2025
ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-49876 6.5 Trương Hữu Phúc (truonghuuphuc) July 10, 2025
ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) Server-Side Request Forgery Patched CVE-2025-49877 6.4 Trương Hữu Phúc (truonghuuphuc) June 12, 2025
ProfileGrid <= 5.9.5.1 - Missing Authorization Patched CVE-2025-48079 4.3 Trương Hữu Phúc (truonghuuphuc) May 16, 2025
ProfileGrid <= 5.9.5.0 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-47478 6.5 Trương Hữu Phúc (truonghuuphuc) May 12, 2025
ProfileGrid <= 5.9.4.8 - Authenticated (Subscriber+) SQL Injection Patched CVE-2025-39586 6.5 Trương Hữu Phúc (truonghuuphuc) April 17, 2025

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation