# ProfileGrid – User Profiles, Groups and Communities

> Custom user profiles plugin ❤ with paid memberships, groups, communities, content restriction, user registration, messaging, WooCommerce memberships, …

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:37 UTC.

## Facts (WordPress.org)

- Slug: `profilegrid-user-profiles-groups-and-communities`
- Author: Metagauss
- Version: 6.0.0.6
- Active installs: 5,000+
- Last update: 2026-11-05 (8 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 3.5, PHP 7.4
- Tags: community, membership, profile, profile widget, user profile
- Page: https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/

## Checks (against WordPress 7.1.4)

- OK: Updated 8 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Breaking ↔ Smooth, Locked in ↔ Portable, Slow ↔ Responsive, Paywalled ↔ Generous, Steep ↔ Easy, Cluttered ↔ Clean.

## Known vulnerabilities

- 2026-10-27 HIGH: Unauthenticated PHP Object Injection (up to 6.0.0.4). WF-a4be6550-39a8-47b4-93a2-aa86e9a01a7b, https://www.wordfence.com/threat-intel/vulnerabilities/id/a4be6550-39a8-47b4-93a2-aa86e9a01a7b?source=api-prod
- 2026-10-09 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 6.0.0.2). CVE-2026-94663, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba6b0143-429f-4c20-a3d4-622b58605ca1?source=api-prod
- 2026-10-01 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 6.0.0.2). CVE-2026-62061, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d984c59-77ff-4283-ac79-910885e46443?source=api-prod
- 2026-08-06 MEDIUM: Missing Authorization (up to 5.0.0.0). CVE-2026-16290, https://www.wordfence.com/threat-intel/vulnerabilities/id/3486ad83-f784-4ffd-bf26-f00c735f3a58?source=api-prod
- 2026-08-03 MEDIUM: Missing Authorization (up to 5.0.0.0). CVE-2026-16289, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a79ac89-b3b4-4e84-b6a9-0f4695bf48ff?source=api-prod
- 2026-08-02 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (before 5.9.9.8). CVE-2026-16291, https://www.wordfence.com/threat-intel/vulnerabilities/id/551272a2-6c2b-45b8-b2e5-330396c5680a?source=api-prod
- 2026-07-30 MEDIUM: Unauthenticated Group Registration Bypass (before 5.9.9.8). CVE-2026-12687, https://www.wordfence.com/threat-intel/vulnerabilities/id/5c28577f-d405-4120-808e-62d0bd9398ac?source=api-prod
- 2026-07-24 MEDIUM: Unauthenticated Payment Bypass (up to 5.9.9.6). CVE-2026-12688, https://www.wordfence.com/threat-intel/vulnerabilities/id/92959269-464f-4845-9381-fffb2ff66c56?source=api-prod
- 2026-07-24 MEDIUM: Missing Authorization (up to 5.9.9.6). CVE-2026-12689, https://www.wordfence.com/threat-intel/vulnerabilities/id/079b5c51-1e59-400c-ad68-10dab1f105b3?source=api-prod
- 2026-07-24 MEDIUM: Missing Authorization (up to 5.9.9.6). CVE-2026-12690, https://www.wordfence.com/threat-intel/vulnerabilities/id/928352ea-f6ce-4bc7-8f0c-8e3c4d075a95?source=api-prod
- 2026-07-13 CRITICAL: Unauthenticated Privilege Escalation via Password Reset (up to 5.9.9.6). CVE-2026-57697, https://www.wordfence.com/threat-intel/vulnerabilities/id/59aebe74-cf53-49f4-8f20-ebb5503d7dbd?source=api-prod
- 2026-07-02 MEDIUM: Cross-Site Request Forgery (up to 6.0.0.2). CVE-2026-57759, https://www.wordfence.com/threat-intel/vulnerabilities/id/fc0a975b-4e8c-48ae-bf59-3267b996bb1e?source=api-prod
- 2026-06-30 CRITICAL: User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite (up to 5.9.9.5). CVE-2026-12073, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d35279d-299e-4ca2-8f84-165284e058c8?source=api-prod
- 2026-06-23 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content (up to 5.9.9.2). CVE-2026-4610, https://www.wordfence.com/threat-intel/vulnerabilities/id/34c64a8b-32ad-4349-b593-933fc057d1a6?source=api-prod
- 2026-05-13 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Group Settings Modification (up to 5.9.8.4). CVE-2026-4607, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f38f9f0-7c15-4c07-b501-b523ea58432a?source=api-prod
- 2026-05-13 MEDIUM: Authenticated (Subscriber+) SQL Injection via 'rid' Parameter (up to 5.9.8.4). CVE-2026-4608, https://www.wordfence.com/threat-intel/vulnerabilities/id/3f58ed72-5a0b-4b43-ad76-7730c79741da?source=api-prod
- 2026-05-13 HIGH: Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining (up to 5.9.8.4). CVE-2026-4609, https://www.wordfence.com/threat-intel/vulnerabilities/id/c3678b4d-0cd0-4873-8cf3-90c557931f4c?source=api-prod
- 2026-03-23 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 5.9.8.1). CVE-2026-25417, https://www.wordfence.com/threat-intel/vulnerabilities/id/f6d3c88d-d0a1-4f27-8a9c-df35235b34dc?source=api-prod
- 2026-03-06 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion (up to 5.9.8.1). CVE-2026-2488, https://www.wordfence.com/threat-intel/vulnerabilities/id/4c611fa0-28ef-4425-8614-fb61e250e625?source=api-prod
- 2026-03-06 MEDIUM: Cross-Site Request Forgery to Group Membership Request Approval/Denial (up to 5.9.8.2). CVE-2026-2494, https://www.wordfence.com/threat-intel/vulnerabilities/id/6b8ffdb9-b8c6-428c-a047-8e5286b2c2fb?source=api-prod
- 2026-02-04 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension (up to 5.9.7.2). CVE-2025-13416, https://www.wordfence.com/threat-intel/vulnerabilities/id/31c2cd54-f258-43ea-8db2-8d98ad7014d1?source=api-prod
- 2026-02-04 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification (up to 5.9.7.2). CVE-2026-1271, https://www.wordfence.com/threat-intel/vulnerabilities/id/712535ce-8c38-4944-aa0a-36d9bacaeb67?source=api-prod
- 2025-09-01 MEDIUM: Reflected Cross-Site Scripting (up to 5.9.5.7). CVE-2025-4957, https://www.wordfence.com/threat-intel/vulnerabilities/id/ea0540d1-3c02-43e7-852c-bf9a6c025fc4?source=api-prod
- 2025-07-24 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 5.9.5.3). CVE-2025-49033, https://www.wordfence.com/threat-intel/vulnerabilities/id/23e1a1e0-fcc2-441f-b77e-1b3d991262ea?source=api-prod
- 2025-07-15 MEDIUM: Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function (up to 5.9.5.4). CVE-2025-6977, https://www.wordfence.com/threat-intel/vulnerabilities/id/addf264e-e23c-4bb6-a898-0fbb4ec28189?source=api-prod
- 2025-07-10 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 5.9.5.2). CVE-2025-49876, https://www.wordfence.com/threat-intel/vulnerabilities/id/e46bd083-ed21-4e2a-b79d-62d9b3c7f1d0?source=api-prod
- 2025-06-19 MEDIUM: Authenticated (Subscriber+) Full Path Disclosure (up to 5.9.5.2). CVE-2025-52719, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a8dcdc-88ab-4e8e-b631-8849e10be9ba?source=api-prod
- 2025-06-12 MEDIUM: Authenticated (Subscriber+) Server-Side Request Forgery (up to 5.9.5.2). CVE-2025-49877, https://www.wordfence.com/threat-intel/vulnerabilities/id/404fc2d1-0c5d-4734-980e-ae3ac293d1f3?source=api-prod
- 2025-05-16 MEDIUM: Missing Authorization (up to 5.9.5.1). CVE-2025-48079, https://www.wordfence.com/threat-intel/vulnerabilities/id/21ca7d14-a6b1-4d02-81c7-bfc5623c4818?source=api-prod
- 2025-05-12 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 5.9.5.0). CVE-2025-47478, https://www.wordfence.com/threat-intel/vulnerabilities/id/655e3795-44c8-498c-a8cd-9985abc9664c?source=api-prod
- 2025-04-17 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 5.9.4.8). CVE-2025-39586, https://www.wordfence.com/threat-intel/vulnerabilities/id/9118acb5-65d7-4058-82f0-0989d33ea44c?source=api-prod
- 2025-03-21 MEDIUM: Authenticated (Subscriber+) SQL Injection (up to 5.9.4.7). CVE-2025-0723, https://www.wordfence.com/threat-intel/vulnerabilities/id/140fa6e8-4381-4df2-af62-44d40b116daf?source=api-prod
- 2025-03-21 MEDIUM: Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management (up to 5.9.4.4). CVE-2025-1408, https://www.wordfence.com/threat-intel/vulnerabilities/id/641f7727-83ba-45c2-b3e1-1ce19f86eac7?source=api-prod
- 2025-03-21 HIGH: Authenticated (Subscriber+) PHP Object Injection (up to 5.9.4.5). CVE-2025-0724, https://www.wordfence.com/threat-intel/vulnerabilities/id/6bb1de69-7bc2-4785-9789-0a2d1cf35b9b?source=api-prod
- 2025-02-23 HIGH: Authenticated (Subscriber+) PHP Object Injection (up to 5.9.4.3). CVE-2025-26999, https://www.wordfence.com/threat-intel/vulnerabilities/id/17dc6988-bbbe-4997-b5f1-230f8003138e?source=api-prod
- 2025-02-17 MEDIUM: Authenticated (Subscriber+) Limited Server-Side Request Forgery (up to 5.9.4.2). CVE-2024-13741, https://www.wordfence.com/threat-intel/vulnerabilities/id/95d2a05d-67ae-45b1-8add-0dcf73d43181?source=api-prod
- 2025-02-17 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure (up to 5.9.4.2). CVE-2024-13740, https://www.wordfence.com/threat-intel/vulnerabilities/id/c2a1b1a4-df72-4666-b116-882af4cd5796?source=api-prod
- 2024-11-19 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion (up to 5.9.3.6). CVE-2024-10900, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e5fcfa-ebc9-45f6-9cbc-c9e3540baa6f?source=api-prod
- 2024-10-14 MEDIUM: Cross-Site Request Forgery (up to 5.9.3). CVE-2024-49273, https://www.wordfence.com/threat-intel/vulnerabilities/id/dcfcb5e8-99e1-4dde-b62e-9f2bfc7db6ef?source=api-prod
- 2024-09-25 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.9.3.2). CVE-2024-8861, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d3188c2-e5b0-4d83-8c92-ae6b409c92f9?source=api-prod
- 2024-07-09 HIGH: Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation (up to 5.8.9). CVE-2024-6411, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef3c7fb-27f5-4829-8cb6-d3a52778a689?source=api-prod
- 2024-07-09 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 5.8.9). CVE-2024-6410, https://www.wordfence.com/threat-intel/vulnerabilities/id/8679f4cd-2cb8-48ad-a531-a00c1b85ed2e?source=api-prod
- 2024-07-01 MEDIUM: Missing Authorization (up to 5.8.7). CVE-2024-37453, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d923bbe-5976-43c5-a34d-d2758c83f607?source=api-prod
- 2024-06-04 MEDIUM: Missing Authorization (up to 5.8.6). CVE-2024-5453, https://www.wordfence.com/threat-intel/vulnerabilities/id/7a44d182-2a43-47c0-ab2e-36c0514c1d47?source=api-prod
- 2024-04-26 MEDIUM: Authenticated (Contributor+) SQL Injection (up to 5.7.1). CVE-2024-30241, https://www.wordfence.com/threat-intel/vulnerabilities/id/e6eea2cb-a2a9-4f65-9aea-b88565e47503?source=api-prod
- 2024-04-22 MEDIUM: Insecure Direct Object Reference (up to 5.7.9). CVE-2024-32808, https://www.wordfence.com/threat-intel/vulnerabilities/id/09b26b78-b587-42f6-a9e3-c2945e91d29e?source=api-prod
- 2024-04-22 MEDIUM: Bypass Group Members Limit (up to 5.8.2). CVE-2024-32774, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e1fce43-03c0-4863-bf0c-60a3c510a01d?source=api-prod
- 2024-04-22 MEDIUM: Insecure Direct Object Reference (up to 5.7.9). CVE-2024-32772, https://www.wordfence.com/threat-intel/vulnerabilities/id/a5be103f-e174-47f9-8a1b-bb0d073c54e4?source=api-prod
- 2024-04-16 MEDIUM: Missing Authorization (up to 5.8.3). CVE-2024-3606, https://www.wordfence.com/threat-intel/vulnerabilities/id/c039d2fe-7518-4724-a025-6380a53fb58c?source=api-prod
- 2024-04-08 MEDIUM: Cross-Site Request Forgery (up to 5.7.8). CVE-2024-31362, https://www.wordfence.com/threat-intel/vulnerabilities/id/134a3615-a9fa-48b5-8cd1-4c3fb24a777a?source=api-prod
- 2024-04-05 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 5.7.6). CVE-2024-31291, https://www.wordfence.com/threat-intel/vulnerabilities/id/de495201-669c-4483-b30d-bb2abf6fe6c6?source=api-prod
- 2024-03-28 CRITICAL: Unauthenticated SQL Injection (up to 5.7.8). CVE-2024-30490, https://www.wordfence.com/threat-intel/vulnerabilities/id/2c4c13c9-6f43-4a4d-b825-e246bf9a1e9c?source=api-prod
- 2024-03-28 CRITICAL: Authenticated (Subscriber+) SQL Injection (up to 5.7.8). CVE-2024-30491, https://www.wordfence.com/threat-intel/vulnerabilities/id/9476b41d-a9a2-46a7-8cf1-62de5d1703b1?source=api-prod
- 2024-03-28 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 5.7.2). CVE-2024-30513, https://www.wordfence.com/threat-intel/vulnerabilities/id/b2436028-9ac2-4232-bccf-26019a26e186?source=api-prod
- 2023-12-28 MEDIUM: Missing Authorization (up to 5.6.6). CVE-2023-52117, https://www.wordfence.com/threat-intel/vulnerabilities/id/71fb1cef-6e01-4bd7-b0bc-5d21295f119a?source=api-prod
- 2023-11-07 MEDIUM: Cross-Site Request Forgery (up to 5.7.1). CVE-2023-47644, https://www.wordfence.com/threat-intel/vulnerabilities/id/f58efd6c-58f2-464b-8aaf-f4f5c4c52f09?source=api-prod
- 2023-07-17 HIGH: Authenticated (Subscriber+) Arbitrary Option Update (up to 5.5.1). CVE-2023-3713, https://www.wordfence.com/threat-intel/vulnerabilities/id/473ba791-af99-4aae-99cb-ccf220e443e7?source=api-prod
- 2023-07-17 MEDIUM: Hardcoded Encryption Key (up to 5.5.0). CVE-2023-3404, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d490bfb-6560-428e-ad91-0f8d8bc9b1f2?source=api-prod
- 2023-07-17 HIGH: Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation (up to 5.5.2). CVE-2023-3714, https://www.wordfence.com/threat-intel/vulnerabilities/id/a4766651-92a6-42c9-81bc-7ea25350f561?source=api-prod
- 2023-07-17 MEDIUM: Missing Authorization to User Import (up to 5.5.1). CVE-2023-3403, https://www.wordfence.com/threat-intel/vulnerabilities/id/b335fc19-2998-4711-8813-6cb68d7447bd?source=api-prod
- 2023-02-27 HIGH: Missing Authorization to Arbitrary Password Reset (up to 5.3.0). CVE-2023-0940, https://www.wordfence.com/threat-intel/vulnerabilities/id/58cf6e80-63dd-42dc-9c4a-7b5c092bc4cb?source=api-prod
- 2022-11-17 MEDIUM: Authenticated (Subscriber+) CSV Injection (up to 5.1.7). CVE-2022-41791, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9337519-0b33-43fa-9be4-2390b8b3afb9?source=api-prod
- 2022-10-27 MEDIUM: Missing Authorization to Information Exposure (up to 5.0.3). CVE-2022-36352, https://www.wordfence.com/threat-intel/vulnerabilities/id/01cfd7db-f62d-4110-b9a4-49ff1e4e5e68?source=api-prod
- 2022-10-19 MEDIUM: Reflected Cross-Site Scripting (up to 5.1.0). CVE-2022-3578, https://www.wordfence.com/threat-intel/vulnerabilities/id/e9489254-dbdc-4754-86d0-d28756b269a9?source=api-prod
- 2022-01-18 MEDIUM: Stored Cross-Site Scripting via Profile (up to 4.7.4). CVE-2022-0233, https://www.wordfence.com/threat-intel/vulnerabilities/id/03e6fa1d-0d6a-43e9-97ff-da874a51474a?source=api-prod
- 2018-05-18 HIGH: Remote Code Execution (before 2.8.6). CVE-2019-15873, https://www.wordfence.com/threat-intel/vulnerabilities/id/f745652d-12d6-46cd-8599-0a42696cb45a?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=profilegrid-user-profiles-groups-and-communities · HTML: https://todaywp.com/plugins/profilegrid-user-profiles-groups-and-communities