Metagauss Profilegrid vulnerabilities

CVE-2024-30490 [CRITICAL] CWE-89 CVE-2024-30490: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

CVE-2024-30491 [HIGH] CWE-89 CVE-2024-30491: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

CVE-2019-15873 [HIGH] CWE-94 CVE-2019-15873: The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote co The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.

CVE-2024-6411 [HIGH] CWE-269 CVE-2024-6411: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privil The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upda

CVE-2023-3714 [HIGH] CWE-862 CVE-2023-3714: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a mis The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group ownership, to update group options, including the 'associate_role' parameter, which defines the membe

CVE-2023-3713 [HIGH] CWE-862 CVE-2023-3713: The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a mis The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update the site options arbitrarily. Thi

CVE-2024-30241 [HIGH] CWE-89 CVE-2024-30241: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.1.

CVE-2023-0940 [HIGH] CWE-863 CVE-2023-0940: The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user passwor The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Administrator ones.

CVE-2025-26999 [HIGH] CWE-502 CVE-2025-26999: Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles- Deserialization of Untrusted Data vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Object Injection.This issue affects ProfileGrid : from n/a through <= 5.9.4.3.

CVE-2025-49876 [HIGH] CWE-89 CVE-2025-49876: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.2.

CVE-2025-0724 [HIGH] CWE-502 CVE-2025-0724: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Ob The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Obje

CVE-2024-32774 [HIGH] CWE-307 CVE-2024-32774: Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid all Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Important Client Functionality.This issue affects ProfileGrid : from n/a through 5.8.2.

CVE-2025-47478 [HIGH] CWE-89 CVE-2025-47478: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.0.

CVE-2025-39586 [HIGH] CWE-89 CVE-2025-39586: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.4.8.

CVE-2025-49033 [HIGH] CWE-89 CVE-2025-49033: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid : from n/a through <= 5.9.5.3.

CVE-2022-3578 [MEDIUM] CWE-79 CVE-2022-3578: The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before output The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

CVE-2024-32772 [HIGH] CWE-639 CVE-2024-32772: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue a Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.

CVE-2024-32808 [HIGH] CWE-639 CVE-2024-32808: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue a Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.

CVE-2022-36352 [HIGH] CWE-862 CVE-2022-36352: Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.

CVE-2024-10900 [HIGH] CWE-862 CVE-2024-10900: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauth The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delet