ProfileGrid vulnerabilities
We track 5 vulnerabilities in ProfileGrid products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2026.
Latest ProfileGrid vulnerabilities
- 9.0 Critical severity
Frontend Dashboard: Deserialization of Untrusted Data
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP ob
- 7.5 High severity
ProfileGrid: Improper Privilege Management
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's con
- 8.8 High severity
ProfileGrid – User Profiles, Memberships…: Missing Authorization
Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.
- 8.8 High severity
ProfileGrid – User Profiles, Memberships…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.6.6.
- 8.8 High severity
ProfileGrid: Incorrect Authorization
The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Admi