Profilegrid
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:profilegrid:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Profilegrid (b90dbcd4-436c-5ddb-823d-e67905c21ba4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-16291 |
vulnerable | 2026-09-16 04:32:57.066685 |
ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.
Published: 2026-08-02T06:00:12.237Z
Updated: 2026-08-04T17:42:27.490Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16289 |
vulnerable | 2026-09-16 04:32:57.045763 |
ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
Published: 2026-08-03T06:00:13.575Z
Updated: 2026-08-03T16:19:22.633Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16290 |
vulnerable | 2026-09-16 04:32:56.917870 |
ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.
Published: 2026-08-06T06:00:09.939Z
Updated: 2026-08-06T14:29:21.620Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12687 |
vulnerable | 2026-09-16 04:32:51.206461 |
ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.
Published: 2026-07-30T06:00:07.916Z
Updated: 2026-07-30T14:01:53.854Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12690 |
vulnerable | 2026-07-29 00:23:32.512614 |
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.
Published: 2026-07-24T06:00:02.850Z
Updated: 2026-07-24T19:45:24.352Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12689 |
vulnerable | 2026-07-29 00:23:32.512495 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12688 |
vulnerable | 2026-07-29 00:23:32.512311 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0940 |
vulnerable | 2026-06-08 05:52:33.484018 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.