Profilegrid (Unknown) - vulnerabilities (CVEs)
8 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-08-06. Vendor: Unknown.
CVEs of Profilegrid
- CVE-2026-16290 - CVSS 5.3 (medium), 2026-08-06: The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for…
- CVE-2026-16289 - CVSS 4.3 (medium), 2026-08-03: The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any…
- CVE-2026-16291 - CVSS 4.3 (medium), 2026-08-02: The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any…
- CVE-2026-12687 - CVSS 7.5 (high), 2026-07-30: The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration,…
- CVE-2026-12690 - CVSS 3.8 (low), 2026-07-24: The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed…
- CVE-2026-12689 - CVSS 5.4 (medium), 2026-07-24: The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing…
- CVE-2026-12688 - CVSS 6.5 (medium), 2026-07-24: The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated…
- CVE-2023-0940 - CVSS 8.8 (high), 2023-03-20: The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows…
