Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: ProfileGrid 5.9.9.7 Clear all filters
TI-2026-10851 CVE-2026-12690 · GHSA-pm67-xc7p-6gp3

ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization

Priority MEDIUM 51

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subs…

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00255 Published 2026-07-24 Fixed in 5.9.9.7 CWE-862
TI-2026-10850 CVE-2026-12689 · GHSA-gv3q-r4q9-h53h

ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization

Priority MEDIUM 58

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0023 Published 2026-07-24 Fixed in 5.9.9.7 CWE-862
TI-2026-10849 CVE-2026-12688 · GHSA-pp2q-mfv3-q5wp

ProfileGrid < 5.9.9.7 - Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery

Priority HIGH 68

The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and mark any user as a pa…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00275 Published 2026-07-24 Fixed in 5.9.9.7 CWE-284