Profilegrid
Vendor:
First CVE: Sep 3, 2019 · Active for 6 years
47
Total CVEs
More Total CVEs than 98% of tracked products
7.8
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 47% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Profilegrid over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 3, 2019
6 years ago
Most Recent CVE
Jul 13, 2026
15 days ago
CVE Severity & Scoring
Profilegrid47 CVEs
43%
55%
All CVEs353,240 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network47 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low46 (97.9%)
High1 (2.1%)
Unknown0 (0.0%)
User Interaction
None37 (78.7%)
Unknown0 (0.0%)
Required10 (21.3%)
Privileges Required
Low37 (78.7%)
High1 (2.1%)
None9 (19.1%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (47 CVEs).
47 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-30491HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8. | Mar 29, 2024 | 8.8 | 40 | NO | NO |
CVE-2024-30490CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8. | Mar 29, 2024 | 9.8 | 40 | NO | YES |
CVE-2026-57759HIGH Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions. | Jul 2, 2026 | 8.8 | 37 | NO | NO |
CVE-2026-57697HIGH Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Password Recovery Exploitat | Jul 13, 2026 | 7.5 | 33 | NO | NO |
CVE-2022-3578MEDIUM The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting | Nov 14, 2022 | 6.1 | 32 | NO | YES |
CVE-2019-15873HIGH The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_ | Sep 3, 2019 | 8.8 | 29 | NO | NO |
CVE-2022-41791HIGH Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. | Nov 17, 2022 | 8.8 | 28 | NO | NO |
CVE-2025-49033HIGH Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows | Aug 14, 2025 | 8.5 | 26 | NO | NO |
CVE-2025-0724HIGH The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization | Mar 22, 2025 | 8.8 | 26 | NO | NO |
CVE-2024-6411HIGH The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lac | Jul 10, 2024 | 8.8 | 26 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (47 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
2 CVEs
4.3% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (47 CVEs).
Media Mentions
Signals from CVEs in this product scope (47 CVEs).
Top CNAs Publishing CVEs For Profilegrid
Top CWEs
Versions
No cataloged versions.