Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ProfileGrid — Vulnerabilities & Security Advisories 34

All 34 CVE vulnerabilities found in ProfileGrid, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses associated with ProfileGrid, a vendor offering identity management solutions, focusing primarily on configuration errors and authentication flaws. The collection encompasses historical advisories and publicly disclosed issues spanning from the product's initial release in 2010 through the most recent updates in 2024. Security professionals and administrators can utilize this resource to track the vendor's official advisory history, analyze patterns within specific weakness classes like improper input validation, or review the complete vulnerability timeline for this software suite. The data is compiled from multiple trusted sources to provide a centralized view of the product's security posture without requiring cross-referencing of disparate databases. By examining the chronological distribution of reported issues, users can identify periods of heightened risk or recurring architectural problems that may require remediation. This repository serves as an essential reference for conducting risk assessments, planning patch management cycles, and understanding the evolution of threats targeting ProfileGrid installations across various enterprise environments. All entries are standardized to ensure consistent reporting of severity levels and affected versions, facilitating accurate impact analysis for organizations relying on this identity governance platform.

Vendor: Unknown

CVE ID Title CVSS Severity Published
CVE-2026-94663 WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability CWE-89 8.5 High 2026-10-09
CVE-2026-62061 WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability CWE-639 5.3 Medium 2026-10-01
CVE-2026-16290 ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group - - 2026-08-06
CVE-2026-16289 ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group - - 2026-08-03
CVE-2026-16291 ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR - - 2026-08-02
CVE-2026-12687 ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID - - 2026-07-30
CVE-2026-12689 ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization - - 2026-07-24
CVE-2026-12688 ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery - - 2026-07-24
CVE-2026-12690 ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization - - 2026-07-24
CVE-2026-57697 WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability CWE-288 7.5 High 2026-07-13
CVE-2026-57759 WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 8.8 High 2026-07-02
CVE-2026-25417 WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2026-03-25
CVE-2025-4957 WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2025-09-26
CVE-2025-49033 WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability CWE-89 8.5 High 2025-08-14
CVE-2025-49876 WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerability CWE-89 8.5 High 2025-07-16
CVE-2025-52719 WordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability CWE-497 4.3 Medium 2025-06-20
CVE-2025-49877 WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability CWE-918 4.9 Medium 2025-06-17
CVE-2025-47478 WordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection Vulnerability CWE-89 8.5 High 2025-05-23
CVE-2025-48079 WordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control Vulnerability CWE-862 4.3 Medium 2025-05-16
CVE-2025-39586 WordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection Vulnerability CWE-89 8.5 High 2025-04-17
CVE-2025-26999 WordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerability CWE-502 8.8 High 2025-03-03
CVE-2024-37453 WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control vulnerability CWE-862 4.3 Medium 2024-11-01
CVE-2024-49273 WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability CWE-862 4.3 Medium 2024-10-21
CVE-2023-52117 WordPress ProfileGrid plugin <= 5.6.6 - Broken Access Control vulnerability CWE-862 4.3 Medium 2024-06-12
CVE-2024-32774 WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability CWE-307 4.3 Medium 2024-05-17
CVE-2024-32772 WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability CWE-639 4.3 Medium 2024-04-24
CVE-2024-32808 WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability CWE-639 5.4 Medium 2024-04-24
CVE-2024-31362 WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 4.3 Medium 2024-04-12
CVE-2024-31291 WordPress ProfileGrid plugin <= 5.7.6 - IDOR on Friend Request vulnerability CWE-639 4.3 Medium 2024-04-07
CVE-2024-30513 WordPress ProfileGrid plugin <= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability CWE-639 6.5 Medium 2024-03-29

All 34 known CVE vulnerabilities affecting ProfileGrid with full Chinese analysis, references, and POCs where available.