ProfileGrid – User Profiles, Groups and Communities vulnerabilities

7 known vulnerabilities in ProfileGrid – User Profiles, Groups and Communities from Metagauss. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  ProfileGrid – User Profiles, Groups and…: Authorization Bypass Through User-Controlled Key

  CVE-2026-12073Jun 30, 2026Metagauss

  The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms

• 7.1 High severity

  ProfileGrid – User Profiles, Groups and…: Missing Authorization

  CVE-2026-4609May 13, 2026Metagauss

  The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up to, and including, 5.9.8.4. This makes it possible for authent

• 8.8 High severity

  ProfileGrid – User Profiles, Groups and…: Deserialization of Untrusted Data

  CVE-2025-0724Mar 22, 2025Metagauss

  The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function. This makes it pos

• 8.1 High severity

  ProfileGrid – User Profiles, Groups and…: Missing Authorization

  CVE-2024-10900Nov 20, 2024Metagauss

  The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This ma

• 8.8 High severity

  ProfileGrid – User Profiles, Groups and…: Improper Privilege Management

  CVE-2024-6411Jul 10, 2024Metagauss

  The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. This

• 8.8 High severity

  ProfileGrid – User Profiles, Groups and…: Missing Authorization

  CVE-2023-3714Jul 18, 2023Metagauss

  The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group owners

• 8.8 High severity

  ProfileGrid – User Profiles, Groups and…: Missing Authorization

  CVE-2023-3713Jul 18, 2023Metagauss

  The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated at