PatchTheCVE: metagauss

CVE-2017-20208: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordP

Wed, 17 Jun 2026 01:15:24 +0000

CRITICAL 9.8: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to 3.7.9.3 (exclusive) via deserialization of untrusted input from the is_expired_by_date() function. This makes it possible for

CVE-2025-6977: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-

Wed, 17 Jun 2026 10:02:58 +0000

MEDIUM 6.1: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pm_get_messenger_notification’ function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possib

CVE-2024-9390: The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, whic

Wed, 17 Jun 2026 08:24:28 +0000

MEDIUM 4.8: The RegistrationMagic WordPress plugin before 6.0.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVE-2024-4665: The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, al

Wed, 17 Jun 2026 08:02:21 +0000

MEDIUM 6.4: The EventPrime WordPress plugin before 3.5.0 does not properly validate permissions when updating bookings, allowing users to change/cancel bookings for other users. Additionally, the feature is lacking a nonce.

CVE-2025-1408: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized mod

Wed, 17 Jun 2026 08:39:05 +0000

MEDIUM 4.3: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_decline_join_group_request and pm_approve_join_group_request functions in all versions up to, and including, 5.9.4.4. This makes

CVE-2025-0724: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injec

Wed, 17 Jun 2026 08:27:02 +0000

HIGH 8.8: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.4.5 via deserialization of untrusted input in the get_user_meta_fields_html function. This makes it possible for authenticated attackers, with

CVE-2025-0723: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-b

Wed, 17 Jun 2026 08:27:02 +0000

MEDIUM 6.5: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind and time-based SQL Injections via the rid and search parameters in all versions up to, and including, 5.9.4.7 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara

CVE-2024-13526: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized acce

Wed, 17 Jun 2026 07:02:11 +0000

MEDIUM 4.3: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the export_submittion_attendees function in all versions up to, and including, 4.0.7.3. This makes it possible for authenticated attackers, w

CVE-2024-13740: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct

Wed, 17 Jun 2026 07:02:38 +0000

MEDIUM 4.3: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.9.4.2 via the pm_messenger_show_messages function due to missing validation on a user controlled key. This makes it possible for auth

CVE-2024-13741: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-S

Wed, 17 Jun 2026 07:02:39 +0000

MEDIUM 5.4: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 5.9.4.2 via the pm_upload_image function. This makes it possible for authenticated attackers, with Subscriber-level access and above

CVE-2025-24686: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagaus

Wed, 17 Jun 2026 08:59:26 +0000

HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Reflected XSS.This issue affects RegistrationMagic: from n/a through <= 6.0.3.3.

CVE-2024-12024: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site

Wed, 17 Jun 2026 06:58:54 +0000

HIGH 7.2: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em_ticket_individual_data parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping.

CVE-2023-49831: Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submi

Wed, 17 Jun 2026 06:36:34 +0000

HIGH 7.5: Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RegistrationMagic: from n/a through <= 5.2.3.0.

CVE-2024-10900: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized mod

Wed, 17 Jun 2026 06:56:39 +0000

MEDIUM 6.5: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attack

CVE-2024-10508: The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulner

Wed, 17 Jun 2026 06:55:49 +0000

CRITICAL 9.8: The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating the password reset token prior to updating

CVE-2024-43223: Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured A

Wed, 17 Jun 2026 07:50:37 +0000

MEDIUM 4.3: Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.0.3.2.

CVE-2024-37453: Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Con

Wed, 17 Jun 2026 07:38:23 +0000

MEDIUM 4.3: Missing Authorization vulnerability in ProfileGrid User Profiles ProfileGrid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 5.8.7.

CVE-2024-9865: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site

Wed, 17 Jun 2026 08:25:24 +0000

MEDIUM 6.1: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for un

CVE-2024-9864: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site

Wed, 17 Jun 2026 08:25:24 +0000

MEDIUM 6.1: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to

CVE-2024-9829: The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil

Wed, 17 Jun 2026 08:25:20 +0000

MEDIUM 6.5: The Download Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability checks on the 'dpwap_handle_download_user' and 'dpwap_handle_download_comment' functions in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers,

CVE-2024-49273: Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities

Wed, 17 Jun 2026 07:59:37 +0000

MEDIUM 4.3: Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities.This issue affects ProfileGrid : from n/a through <= 5.9.3.

CVE-2024-8861: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Sit

Wed, 17 Jun 2026 08:23:26 +0000

MEDIUM 6.4: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.9.3.2 due to incorrect use of the wp_kses_allowed_html function, which allows the 'onclick' attribute for certain HTML elements without su

CVE-2024-8369: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized acce

Wed, 17 Jun 2026 08:22:27 +0000

MEDIUM 5.3: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized access to Private or Password-protected events due to missing authorization checks in all versions up to, and including, 4.0.4.3. This makes it possible for unauthenticated attackers to view pri

CVE-2024-43317: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in M

Wed, 17 Jun 2026 07:50:47 +0000

MEDIUM 4.3: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Metagauss User Registration Team RegistrationMagic allows Cross-Site Scripting (XSS).This issue affects RegistrationMagic: from n/a through 6.0.1.0.

CVE-2024-39643: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in R

Wed, 17 Jun 2026 07:42:22 +0000

MEDIUM 5.8: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in RegistrationMagic Forms RegistrationMagic allows Stored XSS.This issue affects RegistrationMagic: from n/a through 6.0.0.1.

CVE-2024-6411: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escala

Wed, 17 Jun 2026 08:17:57 +0000

HIGH 8.8: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pm_upload_image' AJAX action. This makes it possible for authenticated att

CVE-2024-6410: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct

Wed, 17 Jun 2026 08:17:57 +0000

MEDIUM 4.3: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.8.9 via the 'pm_upload_image' function due to missing validation on a user controlled key. This makes it possible for authenticated a

CVE-2023-52117: Missing Authorization vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid: from n/a through

Wed, 17 Jun 2026 06:42:07 +0000

MEDIUM 4.3: Missing Authorization vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid: from n/a through 5.6.6.

CVE-2024-31275: Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.

Wed, 17 Jun 2026 07:28:06 +0000

HIGH 8.2: Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.

CVE-2024-5453: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized mod

Wed, 17 Jun 2026 08:15:58 +0000

MEDIUM 4.3: The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_dismissible_notice and pm_wizard_update_group_icon functions in all versions up to, and including, 5.8.6. This makes it possible

CVE-2024-32774: Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removi

Wed, 17 Jun 2026 07:30:24 +0000

MEDIUM 4.3: Improper Restriction of Excessive Authentication Attempts vulnerability in Metagauss ProfileGrid allows Removing Important Client Functionality.This issue affects ProfileGrid : from n/a through 5.8.2.

CVE-2023-33321: Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Co

Wed, 17 Jun 2026 06:01:34 +0000

MEDIUM 5.3: Missing Authorization vulnerability in Metagauss EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 2.8.6.

CVE-2024-33947: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagaus

Wed, 17 Jun 2026 07:32:37 +0000

HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic allows Reflected XSS.This issue affects RegistrationMagic: from n/a through 5.3.2.0.

CVE-2024-3606: The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to una

Wed, 17 Jun 2026 07:44:37 +0000

MEDIUM 4.3: The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pm_upload_cover_image function in all versions up to, and including, 5.8.3. This makes it possible for authenticated attac

CVE-2023-23989: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagaus

Wed, 17 Jun 2026 05:38:25 +0000

MEDIUM 5.3: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.1.9.2.

CVE-2024-32808: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects Pro

Wed, 17 Jun 2026 07:30:28 +0000

MEDIUM 5.4: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.

CVE-2024-32772: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects Pro

Wed, 17 Jun 2026 07:30:24 +0000

MEDIUM 4.3: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.9.

CVE-2023-23976: Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not

Wed, 17 Jun 2026 05:38:23 +0000

HIGH 7.5: Incorrect Default Permissions vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.1.9.2.

CVE-2024-31362: Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from

Wed, 17 Jun 2026 07:28:17 +0000

MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

CVE-2024-25935: Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from

Wed, 17 Jun 2026 07:16:45 +0000

MEDIUM 4.3: Missing Authorization vulnerability in Metagauss RegistrationMagic.This issue affects RegistrationMagic: from n/a through 5.2.5.9.

CVE-2024-1991: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordP

Wed, 17 Jun 2026 07:05:36 +0000

HIGH 8.8: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the update_users_role() function in all versions up to, and including, 5.3.0.0. This makes it possible for aut

CVE-2024-1990: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordP

Wed, 17 Jun 2026 07:05:36 +0000

HIGH 8.8: The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to blind SQL Injection via the ‘id’ parameter of the RM_Form shortcode in all versions up to, and including, 5.3.1.0 due to insufficient escaping on the user supplied para

CVE-2024-31291: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects Pro

Wed, 17 Jun 2026 07:28:08 +0000

MEDIUM 4.3: Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.6.