PR
Product
ProfileGrid
49
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 1High 27Medium 21Low 0
Watch
Add ProfileGrid to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-30490 | 9.8 | Mar 29 | WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability Affected: through 5.7.8 |
| CVE-2026-57759 | 8.8 | Jul 2 | WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 6.0.0.2 |
| CVE-2025-0724 | 8.8 | Mar 22 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection Affected: before 5.9.4.6 |
| CVE-2025-26999 | 8.8 | Mar 3 | WordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerability Affected: through 5.9.4.3 |
| CVE-2024-37453 | 8.8 | Nov 1 | WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control vulnerability Affected: before 5.8.8 |
| CVE-2024-6411 | 8.8 | Jul 10 | ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation Affected: before 5.9.0 |
| CVE-2024-32774 | 8.8 | May 17 | WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability Affected: through 5.8.2 |
| CVE-2024-32772 | 8.8 | Apr 24 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability Affected: through 5.7.9 |
| CVE-2024-32808 | 8.8 | Apr 24 | WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability Affected: through 5.7.9 |
| CVE-2024-31362 | 8.8 | Apr 12 | WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 5.7.8 |
| CVE-2024-30491 | 8.8 | Mar 29 | WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability Affected: through 5.7.8 |
| CVE-2024-30241 | 8.8 | Mar 28 | WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection vulnerability Affected: through 5.7.1 |
| CVE-2022-36352 | 8.8 | Jan 8 | WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control Affected: through 5.0.3 |
| CVE-2023-47644 | 8.8 | Nov 18 | WordPress ProfileGrid Plugin <= 5.6.6 is vulnerable to Cross Site Request Forgery (CSRF) Affected: through 5.6.6 |
| CVE-2023-3714 | 8.8 | Jul 18 | ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation Affected: before 5.5.3 |
| CVE-2023-3713 | 8.8 | Jul 18 | ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update Affected: through 5.5.1 |
| CVE-2023-0940 | 8.8 | Mar 20 | ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password Reset Affected: before 5.3.1 |
| CVE-2022-41791 | 8.8 | Nov 17 | WordPress ProfileGrid plugin <= 5.1.6 - Auth. CSV Injection vulnerability Affected: through 5.1.6 |
| CVE-2019-15873 | 8.8 | Sep 3 | The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the… Affected: before 2.8.6 |
| CVE-2026-94663 | 8.5 | Oct 9 | WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability Affected: through 6.0.0.2 |
| CVE-2025-49033 | 8.5 | Aug 14 | WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability Affected: through 5.9.5.3 |
| CVE-2025-49876 | 8.5 | Jul 16 | WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerability Affected: through 5.9.5.2 |
| CVE-2025-47478 | 8.5 | May 23 | WordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection Vulnerability Affected: through 5.9.5.0 |
| CVE-2025-39586 | 8.5 | Apr 17 | WordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection Vulnerability Affected: through 5.9.4.8 |
| CVE-2024-10900 | 8.1 | Nov 20 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion Affected: before 5.9.3.7 |
| CVE-2026-57697 | 7.5 | Jul 13 | WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability Affected: through 5.9.9.6 |
| CVE-2025-4957 | 7.1 | Sep 26 | WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 5.9.5.7 |
| CVE-2024-31291 | 7.1 | Apr 7 | WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability Affected: through 5.7.6 |
| CVE-2026-25417 | 6.5 | Mar 25 | WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability Affected: through 5.9.8.1 |
| CVE-2025-0723 | 6.5 | Mar 22 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection Affected: before 5.9.4.8 |
| CVE-2024-49273 | 6.5 | Oct 21 | WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 5.9.3 |
| CVE-2024-30513 | 6.5 | Mar 29 | WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability Affected: through 5.7.2 |
| CVE-2023-52117 | 6.3 | Jun 12 | WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerability Affected: through 5.6.6 |
| CVE-2025-6977 | 6.1 | Jul 16 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function Affected: before 5.9.5.5 |
| CVE-2022-3578 | 6.1 | Nov 14 | ProfileGrid < 5.1.1 - Reflected Cross-Site Scripting Affected: before 5.1.1 |
| CVE-2024-13741 | 5.4 | Feb 18 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery Affected: before 5.9.4.3 |
| CVE-2024-8861 | 5.4 | Sep 26 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: before 5.9.3.3 |
| CVE-2022-0233 | 5.4 | Jan 18 | The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the… Affected: through 4.7.4 |
| CVE-2026-62061 | 5.3 | Oct 1 | WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability Affected: through 6.0.0.2 |
| CVE-2025-49877 | 4.9 | Jun 17 | WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability Affected: through 5.9.5.2 |
| CVE-2023-3404 | 4.9 | Aug 31 | ProfileGrid <= 5.5.0 - Hardcoded Encryption Key Affected: through 5.5.0 |
| CVE-2025-52719 | 4.3 | Jun 20 | WordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability Affected: through 5.9.5.2 |
| CVE-2025-48079 | 4.3 | May 16 | WordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control Vulnerability Affected: through 5.9.5.1 |
| CVE-2025-1408 | 4.3 | Mar 22 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management Affected: before 5.9.4.5 |
| CVE-2024-13740 | 4.3 | Feb 18 | ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure Affected: before 5.9.4.3 |
| CVE-2024-6410 | 4.3 | Jul 10 | ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference Affected: before 5.9.0 |
| CVE-2024-5453 | 4.3 | Jun 5 | ProfileGrid <= 5.8.6 - Missing Authorization Affected: before 5.8.7 |
| CVE-2024-3606 | 4.3 | May 2 | ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization Affected: before 5.8.4 |
| CVE-2023-3403 | 4.3 | Jul 18 | ProfileGrid <= 5.5.1 - Missing Authorization to User Import Affected: through 5.5.1 |
Showing 49