ProfileGrid – User Profiles, Groups and Communities vulnerabilities
Plugin slug profilegrid-user-profiles-groups-and-communities · 65 known vulnerabilities · latest disclosed 2026-10-27 · WordPress.org page
Every listed vulnerability has a fix. Version 6.0.0.5 or later is not affected by any of them. If your site runs an older version, update it.
13 of 65 rated high or critical (CVSS 7 or more).
Known vulnerabilities in ProfileGrid – User Profiles, Groups and Communities
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| High 8.1 | <= 6.0.0.4 | 6.0.0.5 | CVE-2026-103693 | 2026-10-27 | Advisory |
| Medium 6.5 | <= 6.0.0.2 | 6.0.0.3 | CVE-2026-94663 | 2026-10-04 | Advisory |
| Medium 5.3 | <= 6.0.0.2 | 6.0.0.3 | CVE-2026-62061 | 2026-10-01 | Advisory |
| Medium 4.3 | < 5.9.9.8 | 5.9.9.8 | CVE-2026-16291 | 2026-08-02 | Advisory |
| Medium 5.3 | <= 5.0.0.0 | 6.0.0.0 | CVE-2026-16290 | 2026-07-30 | Advisory |
| Medium 4.3 | <= 5.0.0.0 | 6.0.0.0 | CVE-2026-16289 | 2026-07-24 | Advisory |
| Medium 6.5 | < 5.9.9.8 | 5.9.9.8 | CVE-2026-12687 | 2026-07-10 | Advisory |
| Critical 9.8 | <= 5.9.9.6 | 5.9.9.7 | CVE-2026-57697 | 2026-07-08 | Advisory |
| Medium 4.3 | <= 5.9.9.6 | 5.9.9.7 | CVE-2026-12689 | 2026-07-03 | Advisory |
| Medium 4.3 | <= 5.9.9.6 | 5.9.9.7 | CVE-2026-12690 | 2026-07-03 | Advisory |
| Medium 5.3 | <= 5.9.9.6 | 5.9.9.7 | CVE-2026-12688 | 2026-07-03 | Advisory |
| Medium 4.3 | <= 6.0.0.2 | 6.0.0.3 | CVE-2026-57759 | 2026-07-02 | Advisory |
| Critical 9.8 | <= 5.9.9.5 | 5.9.9.6 | CVE-2026-12073 | 2026-06-29 | Advisory |
| Medium 6.4 | <= 5.9.9.2 | 5.9.9.3 | CVE-2026-4610 | 2026-06-22 | Advisory |
| Medium 6.5 | <= 5.9.8.4 | 5.9.8.5 | CVE-2026-4608 | 2026-05-12 | Advisory |
| Medium 4.3 | <= 5.9.8.4 | 5.9.8.5 | CVE-2026-4607 | 2026-05-12 | Advisory |
| High 7.1 | <= 5.9.8.4 | 5.9.8.5 | CVE-2026-4609 | 2026-05-12 | Advisory |
| Medium 6.4 | <= 5.9.8.1 | 5.9.8.2 | CVE-2026-25417 | 2026-03-23 | Advisory |
| Medium 4.3 | <= 5.9.8.1 | 5.9.8.2 | CVE-2026-2488 | 2026-03-06 | Advisory |
| Medium 4.3 | <= 5.9.8.2 | 5.9.8.3 | CVE-2026-2494 | 2026-03-06 | Advisory |
| Medium 5.3 | <= 5.9.7.2 | 5.9.7.3 | CVE-2026-1271 | 2026-02-04 | Advisory |
| Medium 4.3 | <= 5.9.7.2 | 5.9.7.3 | CVE-2025-13416 | 2026-02-04 | Advisory |
| Medium 6.1 | <= 5.9.5.7 | 5.9.5.8 | CVE-2025-4957 | 2025-09-01 | Advisory |
| Medium 6.5 | <= 5.9.5.3 | 5.9.5.4 | CVE-2025-49033 | 2025-07-24 | Advisory |
| Medium 6.1 | <= 5.9.5.4 | 5.9.5.5 | CVE-2025-6977 | 2025-07-15 | Advisory |
| Medium 6.5 | <= 5.9.5.2 | 5.9.5.3 | CVE-2025-49876 | 2025-07-10 | Advisory |
| Medium 4.3 | <= 5.9.5.2 | 5.9.5.3 | CVE-2025-52719 | 2025-06-19 | Advisory |
| Medium 6.4 | <= 5.9.5.2 | 5.9.5.3 | CVE-2025-49877 | 2025-06-12 | Advisory |
| Medium 4.3 | <= 5.9.5.1 | 5.9.5.2 | CVE-2025-48079 | 2025-05-16 | Advisory |
| Medium 6.5 | <= 5.9.5.0 | 5.9.5.1 | CVE-2025-47478 | 2025-05-12 | Advisory |
| Medium 6.5 | <= 5.9.4.8 | 5.9.4.9 | CVE-2025-39586 | 2025-04-17 | Advisory |
| High 8.8 | <= 5.9.4.5 | 5.9.4.6 | CVE-2025-0724 | 2025-03-21 | Advisory |
| Medium 4.3 | <= 5.9.4.4 | 5.9.4.5 | CVE-2025-1408 | 2025-03-21 | Advisory |
| Medium 6.5 | <= 5.9.4.7 | 5.9.4.8 | CVE-2025-0723 | 2025-03-21 | Advisory |
| High 8.8 | <= 5.9.4.3 | 5.9.4.4 | CVE-2025-26999 | 2025-02-23 | Advisory |
| Medium 4.3 | <= 5.9.4.2 | 5.9.4.3 | CVE-2024-13740 | 2025-02-17 | Advisory |
| Medium 5.4 | <= 5.9.4.2 | 5.9.4.3 | CVE-2024-13741 | 2025-02-17 | Advisory |
| Medium 6.5 | <= 5.9.3.6 | 5.9.3.7 | CVE-2024-10900 | 2024-11-19 | Advisory |
| Medium 4.3 | <= 5.9.3 | 5.9.3.1 | CVE-2024-49273 | 2024-10-14 | Advisory |
| Medium 6.4 | <= 5.9.3.2 | 5.9.3.3 | CVE-2024-8861 | 2024-09-25 | Advisory |
| Medium 4.3 | <= 5.8.9 | 5.9.0 | CVE-2024-6410 | 2024-07-09 | Advisory |
| High 8.8 | <= 5.8.9 | 5.9.0 | CVE-2024-6411 | 2024-07-09 | Advisory |
| Medium 5.4 | <= 5.8.7 | 5.8.8 | CVE-2024-37453 | 2024-07-01 | Advisory |
| Medium 4.3 | <= 5.8.6 | 5.8.7 | CVE-2024-5453 | 2024-06-04 | Advisory |
| Medium 6.4 | <= 5.7.1 | 5.7.2 | CVE-2024-30241 | 2024-04-26 | Advisory |
| Medium 4.3 | <= 5.7.9 | 5.8.0 | CVE-2024-32808 | 2024-04-22 | Advisory |
| Medium 4.3 | <= 5.7.9 | 5.8.0 | CVE-2024-32772 | 2024-04-22 | Advisory |
| Medium 4.3 | <= 5.8.3 | 5.8.4 | CVE-2024-3606 | 2024-04-16 | Advisory |
| Medium 4.3 | <= 5.7.8 | 5.7.9 | CVE-2024-31362 | 2024-04-08 | Advisory |
| Medium 4.3 | <= 5.7.6 | 5.7.7 | CVE-2024-31291 | 2024-04-05 | Advisory |
| Critical 10 | <= 5.7.8 | 5.7.9 | CVE-2024-30490 | 2024-03-28 | Advisory |
| Critical 9.9 | <= 5.7.8 | 5.7.9 | CVE-2024-30491 | 2024-03-28 | Advisory |
| Medium 4.3 | <= 5.7.2 | 5.7.3 | CVE-2024-30513 | 2024-03-28 | Advisory |
| Medium 4.3 | <= 5.6.6 | 5.6.7 | CVE-2023-52117 | 2023-12-28 | Advisory |
| Medium 4.3 | <= 5.7.1 | 5.7.2 | CVE-2023-47644 | 2023-11-07 | Advisory |
| High 8.8 | <= 5.5.1 | 5.5.2 | CVE-2023-3713 | 2023-07-17 | Advisory |
| Medium 4.9 | <= 5.5.0 | 5.5.1 | CVE-2023-3404 | 2023-07-17 | Advisory |
| High 7.5 | <= 5.5.2 | 5.5.3 | CVE-2023-3714 | 2023-07-17 | Advisory |
| Medium 5.4 | <= 5.5.1 | 5.5.2 | CVE-2023-3403 | 2023-07-17 | Advisory |
| High 8.8 | <= 5.3.0 | 5.3.1 | CVE-2023-0940 | 2023-02-27 | Advisory |
| Medium 6.3 | <= 5.1.7 | 5.1.8 | CVE-2022-41791 | 2022-11-17 | Advisory |
| Medium 5.4 | <= 5.0.3 | 5.0.4 | CVE-2022-36352 | 2022-10-27 | Advisory |
| Medium 6.1 | <= 5.1.0 | 5.1.1 | CVE-2022-3578 | 2022-10-19 | Advisory |
| Medium 6.4 | <= 4.7.4 | 4.7.7 | CVE-2022-0233 | 2022-01-18 | Advisory |
| High 8.8 | < 2.8.6 | 2.8.6 | CVE-2019-15873 | 2018-05-18 | Advisory |
Check if a site is affected
Enter a site address to see which version of ProfileGrid – User Profiles, Groups and Communities and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the ProfileGrid – User Profiles, Groups and Communities plugin safe to use?
All 65 known issues are fixed in current versions (6.0.0.5 or later). Keeping it updated is what matters.
How do I check which version of ProfileGrid – User Profiles, Groups and Communities my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome