Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

ProfileGrid – User Profiles, Groups and Communities Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 59 vulnerability records associated with ProfileGrid – User Profiles, Groups and Communities, published between 2018 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

59Total records
4Critical
8High
46Medium
0Low
1Informational
58Patched records
1Currently marked unpatched
2018-05-18First disclosure
2026-07-08Latest disclosure
59 of 59CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201811 records
202244 records
202377 records
20241717 records
20251515 records
20261515 records

Severity Breakdown

SeverityRecordsShare
Critical46.8%
High813.6%
Medium4678%
Informational11.7%

Vulnerability-Type Breakdown

Missing Authorization

27 records45.8%

First: 2022. Latest: 2026.

SQL Injection

9 records15.3%

First: 2024. Latest: 2026.

Other

7 records11.9%

First: 2018. Latest: 2025.

Cross-Site Scripting

7 records11.9%

First: 2022. Latest: 2026.

CSRF

5 records8.5%

First: 2023. Latest: 2026.

Privilege Escalation

3 records5.1%

First: 2024. Latest: 2026.

Information Disclosure

1 record1.7%

First: 2025. Latest: 2025.

Patch Status

Patched
58
Currently marked unpatched
1
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 5.9.9.7
  • 5.9.9.6
  • 5.9.9.3
  • 5.9.8.5
  • 5.9.8.2
  • 5.9.8.3
  • 5.9.7.3
  • 5.9.5.8
  • 5.9.5.4
  • 5.9.5.5
  • 5.9.5.3
  • 5.9.5.2
  • 5.9.5.1
  • 5.9.4.9
  • 5.9.4.6
  • 5.9.4.5
  • 5.9.4.8
  • 5.9.4.4
  • 5.9.4.3
  • 5.9.3.7
  • 5.9.3.1
  • 5.9.3.3
  • 5.9.0
  • 5.8.8
  • 5.8.7
  • 5.7.2
  • 5.8.3
  • 5.8.0
  • 5.8.4
  • 5.7.9
  • 5.7.7
  • 5.7.3
  • 5.6.7
  • 5.5.3
  • 5.5.1
  • 5.5.2
  • 5.3.1
  • 5.1.8
  • 5.0.4
  • 5.1.1
  • 4.7.7
  • 2.8.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-5.9.4.4ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests ManagementMarch 21, 20255.9.4.5Medium
*-5.9.4.7ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL InjectionMarch 21, 20255.9.4.8Medium
*-5.9.4.3ProfileGrid <= 5.9.4.3 - Authenticated (Subscriber+) PHP Object InjectionFebruary 23, 20255.9.4.4High
*-5.9.4.2ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages DisclosureFebruary 17, 20255.9.4.3Medium
*-5.9.4.2ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request ForgeryFebruary 17, 20255.9.4.3Medium
*-5.9.3.6ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta DeletionNovember 19, 20245.9.3.7Medium
*-5.9.3ProfileGrid <= 5.9.3 - Cross-Site Request ForgeryOctober 14, 20245.9.3.1Medium
*-5.9.3.2ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingSeptember 25, 20245.9.3.3Medium
*-5.8.9ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object ReferenceJuly 9, 20245.9.0Medium
*-5.8.9ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege EscalationJuly 9, 20245.9.0High
*-5.8.7ProfileGrid <= 5.8.7 - Missing AuthorizationJuly 1, 20245.8.8Medium
*-5.8.6ProfileGrid <= 5.8.6 - Missing AuthorizationJune 4, 20245.8.7Medium
*-5.7.1ProfileGrid <= 5.7.1 - Authenticated (Contributor+) SQL InjectionApril 26, 20245.7.2Medium
*-5.7.9ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object ReferenceApril 22, 20245.8.0Medium
*-5.8.2ProfileGrid <= 5.8.2 - Bypass Group Members LimitApril 22, 20245.8.3Medium
*-5.7.9ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object ReferenceApril 22, 20245.8.0Medium
*-5.8.3ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing AuthorizationApril 16, 20245.8.4Medium
*-5.7.8ProfileGrid <= 5.7.8 - Cross-Site Request ForgeryApril 8, 20245.7.9Medium
*-5.7.6ProfileGrid <= 5.7.6 - Authenticated (Subscriber+) Insecure Direct Object ReferenceApril 5, 20245.7.7Medium
*-5.7.2ProfileGrid <= 5.7.2 - Authenticated (Subscriber+) Insecure Direct Object ReferenceMarch 28, 20245.7.3Medium
*-5.7.8ProfileGrid <= 5.7.8 - Authenticated (Subscriber+) SQL InjectionMarch 28, 20245.7.9Critical
*-5.7.8ProfileGrid <= 5.7.8 - Unauthenticated SQL InjectionMarch 28, 20245.7.9Critical
*-5.6.6ProfileGrid <= 5.6.6 - Missing AuthorizationDecember 28, 20235.6.7Medium
*-5.7.1ProfileGrid <= 5.7.1 - Cross-Site Request ForgeryNovember 7, 20235.7.2Medium
*-5.5.1ProfileGrid <= 5.5.1 - Missing Authorization to User ImportJuly 17, 20235.5.2Medium

Selected source records

Latest Records

CriticalCVE-2026-57697

ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset

Published: July 8, 2026

Affected versions
*-5.9.9.6
Patched versions
5.9.9.7
Original Wordfence record
MediumCVE-2026-12689

ProfileGrid <= 5.9.9.6 - Missing Authorization

Published: July 3, 2026

Affected versions
*-5.9.9.6
Patched versions
5.9.9.7
Original Wordfence record
MediumCVE-2026-12690

ProfileGrid <= 5.9.9.6 - Missing Authorization

Published: July 3, 2026

Affected versions
*-5.9.9.6
Patched versions
5.9.9.7
Original Wordfence record
MediumCVE-2026-12688

ProfileGrid <= 5.9.9.6 - Unauthenticated Payment Bypass

Published: July 3, 2026

Affected versions
*-5.9.9.6
Patched versions
5.9.9.7
Original Wordfence record
MediumCVE-2026-57759

ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.8 - Cross-Site Request Forgery

Published: July 2, 2026

Affected versions
*-5.9.9.8
Patched versions
Not supplied
Original Wordfence record
CriticalCVE-2026-12073

ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

Published: June 29, 2026

Affected versions
*-5.9.9.5
Patched versions
5.9.9.6
Original Wordfence record
MediumCVE-2026-4610

ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content

Published: June 22, 2026

Affected versions
*-5.9.9.2
Patched versions
5.9.9.3
Original Wordfence record
MediumCVE-2026-4608

ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter

Published: May 12, 2026

Affected versions
*-5.9.8.4
Patched versions
5.9.8.5
Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-30490

ProfileGrid <= 5.7.8 - Unauthenticated SQL Injection

Published: March 28, 2024

Affected versions
*-5.7.8
Patched versions
5.7.9
Original Wordfence record
CriticalCVE-2024-30491

ProfileGrid <= 5.7.8 - Authenticated (Subscriber+) SQL Injection

Published: March 28, 2024

Affected versions
*-5.7.8
Patched versions
5.7.9
Original Wordfence record
CriticalCVE-2026-12073

ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite

Published: June 29, 2026

Affected versions
*-5.9.9.5
Patched versions
5.9.9.6
Original Wordfence record
CriticalCVE-2026-57697

ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset

Published: July 8, 2026

Affected versions
*-5.9.9.6
Patched versions
5.9.9.7
Original Wordfence record
HighCVE-2025-26999

ProfileGrid <= 5.9.4.3 - Authenticated (Subscriber+) PHP Object Injection

Published: February 23, 2025

Affected versions
*-5.9.4.3
Patched versions
5.9.4.4
Original Wordfence record
HighCVE-2024-6411

ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation

Published: July 9, 2024

Affected versions
*-5.8.9
Patched versions
5.9.0
Original Wordfence record
HighCVE-2023-3713

ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update

Published: July 17, 2023

Affected versions
*-5.5.1
Patched versions
5.5.2
Original Wordfence record
HighCVE-2023-0940

ProfileGrid <= 5.3.0 - Missing Authorization to Arbitrary Password Reset

Published: February 27, 2023

Affected versions
*-5.3.0
Patched versions
5.3.1
Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2026-57759

ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.8 - Cross-Site Request Forgery

Published: July 2, 2026

Affected versions
*-5.9.9.8
Patched versions
Not supplied
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory