Metagauss
Metagauss Profilegrid: vulnerabilidades y CVE
Metagauss Profilegrid tiene 64 vulnerabilidades publicadas, 20 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE64
Últimos 12 meses20
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-62061 | Media (5.3) | — | — | 1 oct 2026 | Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
| CVE-2026-16290 | Media (5.3) | 0.35% | — | 6 ago 2026 | The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to… |
| CVE-2026-16289 | Media (4.3) | 0.27% | — | 3 ago 2026 | The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and… |
| CVE-2026-16291 | Media (4.3) | 0.25% | — | 2 ago 2026 | The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users'… |
| CVE-2026-12687 | Alta (7.5) | 0.41% | — | 30 jul 2026 | The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a… |
| CVE-2026-12690 | Baja (3.8) | 0.26% | — | 24 jul 2026 | The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with… |
| CVE-2026-12689 | Media (5.4) | 0.23% | — | 24 jul 2026 | The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to… |
| CVE-2026-12688 | Media (6.5) | 0.27% | — | 24 jul 2026 | The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a… |
| CVE-2026-57697 | Alta (7.5) | 0.48% | — | 13 jul 2026 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitation.This issue affects ProfileGrid :… |
| CVE-2026-57759 | Alta (8.8) | 0.20% | — | 2 jul 2026 | Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2. |
| CVE-2026-12073 | Crítica (9.8) | 0.53% | — | 30 jun 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not… |
| CVE-2026-4610 | Media (6.4) | 0.35% | — | 23 jun 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions… |
| CVE-2026-4609 | Alta (7.1) | 0.38% | — | 13 may 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_user function in all versions up to, and including,… |
| CVE-2026-4608 | Media (6.5) | 0.45% | — | 13 may 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to, and including, 5.9.8.4 due to insufficient escaping on the… |
| CVE-2026-4607 | Media (4.3) | 0.39% | — | 13 may 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4. This is due to the plugin not properly verifying that a… |
| CVE-2026-25417 | Media (6.5) | 0.16% | — | 25 mar 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects… |
| CVE-2026-2494 | Media (4.3) | 0.13% | — | 7 mar 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.8.2. This is due to missing nonce validation on the… |
| CVE-2026-2488 | Media (4.3) | 0.22% | — | 7 mar 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing capability check on the pg_delete_msg() function in all versions up to, and… |
| CVE-2026-1271 | Media (5.3) | 0.34% | — | 5 feb 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.7.2 via the 'pm_upload_image' and… |
| CVE-2025-13416 | Media (4.3) | 0.30% | — | 5 feb 2026 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on the pm_deactivate_user_from_group() function in all… |
| CVE-2025-4957 | Alta (7.1) | 0.24% | — | 26 sept 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Reflected XSS.This issue affects… |
| CVE-2025-49033 | Alta (8.5) | 0.27% | — | 14 ago 2025 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects… |
| CVE-2025-49876 | Alta (8.5) | 0.34% | — | 16 jul 2025 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects… |
| CVE-2025-6977 | Media (6.1) | 0.29% | — | 16 jul 2025 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pm_get_messenger_notification’ function in all versions up to, and including, 5.9.5.4… |
| CVE-2025-52719 | Media (4.3) | 0.25% | — | 20 jun 2025 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Retrieve Embedded Sensitive Data.This issue… |
| CVE-2025-49877 | Media (4.9) | 0.17% | — | 17 jun 2025 | Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Server Side Request Forgery.This issue affects ProfileGrid : from n/a through <= 5.9.5.2. |
| CVE-2025-47478 | Alta (8.5) | 0.40% | — | 23 may 2025 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects… |
| CVE-2025-48079 | Media (4.3) | 0.23% | — | 16 may 2025 | Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid : from… |
| CVE-2025-39586 | Alta (8.5) | 0.34% | — | 17 abr 2025 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects… |
| CVE-2025-1408 | Media (4.3) | 0.29% | — | 22 mar 2025 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.