sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total52
Critical2
High11
Medium38
Reset
Showing 21-40 of 52 records
Threat Entry Updated 2026-06-17

Profilegrid - Broken Access Control (CVE-2025-1408)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to approve or decline join group requests which is normally should be available to administrators only.

PLUGIN Profilegrid

CVE-2025-1408

MEDIUM CVSS 4.3 2025-03-22
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Security Vulnerability (CVE-2024-13740)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pm_messenger_show_messages function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read private conversations of other users.

PLUGIN Profilegrid

CVE-2024-13740

MEDIUM CVSS 4.3 2025-02-18
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Server-Side Request Forgery (SSRF) (CVE-2024-13741)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pm_upload_image function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to download and view images, as well as validating if a non-image file exists, both on local or remote hosts.

PLUGIN Profilegrid

CVE-2024-13741

MEDIUM CVSS 5.4 2025-02-18
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Broken Access Control (CVE-2024-10900)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary user meta which can do things like deny an administrator's access to their site. .

PLUGIN Profilegrid

CVE-2024-10900

MEDIUM CVSS 6.5 2024-11-20
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Cross-Site Scripting (XSS) (CVE-2024-8861)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.3.2 due to incorrect use of the wp_kses_allowed_html function, which allows the 'onclick' attribute for certain HTML elements without sufficient restriction or context validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Profilegrid

CVE-2024-8861

MEDIUM CVSS 6.4 2024-09-26
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Privilege Escalation (CVE-2024-6411)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their user capabilities to Administrator.

PLUGIN Profilegrid

CVE-2024-6411

HIGH CVSS 8.8 2024-07-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Security Vulnerability (CVE-2024-6410)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the profile picture of any user.

PLUGIN Profilegrid

CVE-2024-6410

MEDIUM CVSS 4.3 2024-07-10
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Broken Access Control (CVE-2024-5453)

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary options to the value '1' or change group icons.

PLUGIN Profilegrid

CVE-2024-5453

MEDIUM CVSS 4.3 2024-06-05
Open Full Technical Breakdown
Threat Entry Updated 2026-06-17

Profilegrid - Broken Access Control (CVE-2024-3606)

The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pm_upload_cover_image function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attackers, with subscriber access or higher, to delete attachments.

PLUGIN Profilegrid

CVE-2024-3606

MEDIUM CVSS 4.3 2024-05-02
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.