CVE-2024-30490: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid…

PriorityP266critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

2.27%

80.8th percentile

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
metagauss	profilegrid	< 5.7.9	5.7.9
metagauss	profilegrid	n/a – 5.7.8	—

Detection & IOCsextracted from sources · hover to see the quote

otherProfileGrid =7'

→Target the ProfileGrid WordPress plugin versions up to and including 5.7.8 for SQL injection vulnerability (CVE-2024-30490); payloads likely manipulate group-related query parameters. ↗

·The nuclei/detection template digest should be verified against the canonical template repository before deployment, as the source URL for the template document was not provided.
·The SQL injection affects all ProfileGrid versions from n/a through 5.7.8; versions above 5.7.8 are not confirmed vulnerable per the NVD advisory. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.