Profilegrid
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:profilegrid:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Profilegrid (b90dbcd4-436c-5ddb-823d-e67905c21ba4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-103693 |
vulnerable | 2026-11-03 10:15:49.457845 |
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
Published: 2026-10-29T06:00:23.681Z
Updated: 2026-10-29T10:56:07.950Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16291 |
vulnerable | 2026-09-16 04:32:57.066685 |
ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR
The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers.
Published: 2026-08-02T06:00:12.237Z
Updated: 2026-08-04T17:42:27.490Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16289 |
vulnerable | 2026-09-16 04:32:57.045763 |
ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to disclose the names and request dates of the users awaiting approval to join any group, including private ones.
Published: 2026-08-03T06:00:13.575Z
Updated: 2026-08-03T16:19:22.633Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-16290 |
vulnerable | 2026-09-16 04:32:56.917870 |
ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group
The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or closed ones, bypassing the ProfileGrid WordPress plugin before 6.0.0.0's member-visibility setting.
Published: 2026-08-06T06:00:09.939Z
Updated: 2026-08-06T14:29:21.620Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12687 |
vulnerable | 2026-09-16 04:32:51.206461 |
ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID
The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.
Published: 2026-07-30T06:00:07.916Z
Updated: 2026-07-30T14:01:53.854Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12690 |
vulnerable | 2026-07-29 00:23:32.512614 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12689 |
vulnerable | 2026-07-29 00:23:32.512495 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12688 |
vulnerable | 2026-07-29 00:23:32.512311 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0940 |
vulnerable | 2026-06-08 05:52:33.484018 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.