PatchTheCVEprofilegrid vulnerabilities and fixes
Recent CVEs affecting profilegrid, with upgrade or downgrade steps. 10 tracked.
profilegrid has 10 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 10. Most recent: 2025-07-16. Highest priority: CVE-2025-0724 (score 43/100).
- CVE-2025-6977 MEDIUM 6.1 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-
- CVE-2025-1408 MEDIUM 4.3 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized mod
- CVE-2025-0724 HIGH 8.8 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injec
- CVE-2025-0723 MEDIUM 6.5 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-b
- CVE-2024-8861 MEDIUM 6.4 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Sit
- CVE-2024-49273 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities
- CVE-2024-37453 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Con
- CVE-2024-13741 MEDIUM 5.4 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-S
- CVE-2024-13740 MEDIUM 4.3 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct
- CVE-2024-10900 MEDIUM 6.5 UPGRADE The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized mod
FAQ
How do I fix profilegrid vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is profilegrid being exploited right now?
None of the tracked profilegrid CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which profilegrid CVE should I patch first?
CVE-2025-0724 currently ranks highest (43/100): The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injec.