ProfileGrid – User Profiles, Groups and Communities

Vulnerabilities 53Slug profilegrid-user-profiles-groups-and-communitiesLatest version 5.9.9.2WordPress.org →

Minimum safe version

5.9.8.3

Update to 5.9.8.3 or later to address 53 fixable vulnerabilities

Latest available5.9.9.2 ✓
High 7.1
2025-09-26< 5.9.5.8

ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.7 - Reflected Cross-Site Scripting

EUVDWordfenceCVE
N/A
2026-02-04< 5.9.7.3

ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification

WordfenceCVE
N/A
2026-03-06< 5.9.8.2

ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion

WordfenceCVE
N/A
2026-03-06< 5.9.8.3

ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial

WordfenceCVE
Medium 6.5
2026-03-25< 5.9.8.2

CVE-2026-25417

CVEWordfence
Medium 4.3
2026-02-05< 5.9.7.3

CVE-2025-13416

CVEWordfence
Medium 6.1
2025-07-16< 5.9.5.5

ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function

EUVDWordfenceCVE
High 8.8
2025-03-22< 5.9.4.6

ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection

EUVDWordfenceCVE
Medium 4.3
2025-03-22< 5.9.4.5

ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management

EUVDWordfenceCVE
Medium 6.5
2025-03-22< 5.9.4.8

ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection

EUVDWordfenceCVE
High 8.5
2024-04-26< 5.7.2

ProfileGrid <= 5.7.1 - Authenticated (Contributor+) SQL Injection

WordfenceCVEPatchstack
N/A
< 5.0.4

ProfileGrid &lt; 5.0.4 - Subscriber+ Private Message Read/Edition

WPScan
N/A
2022-10-27< 5.0.4

ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.0.3 - Missing Authorization to Information Exposure

Wordfence
Medium 6.1
2022-11-15< 5.1.1

WordPress ProfileGrid plugin <= 5.1.0 - Reflected Cross-Site Scripting (XSS) vulnerability

PatchstackCVEWordfenceWPScan
N/A
2017-11-27< 2.6.7

WordPress ProfileGrid Plugin <= 2.6.6 - Reflected Cross Site Scripting

Patchstack
N/A
2018-06-05< 2.8.6

WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 2.8.5 - Authenticated Code Execution vulnerability

Patchstack