Profilegrid CVE-2026-25417

Although CVSS and EPSS scores are not provided, the risk profile can be assessed through available signals: (1) Attack Vector is likely Network with Low or Medium Complexity given typical WordPress plugin architecture, (2) Stored XSS vulnerabilities are inherently high-impact because the payload persists and affects multiple users, (3) The vulnerability was reported by Patchstack, a reputable security researcher organization, lending credibility to its authenticity, (4) The presence of an ENISA EUVD identifier (EUVD-2026-15723) indicates official European vulnerability tracking, suggesting formal verification, (5) No KEV (Known Exploited Vulnerability) status is mentioned, but this does not guarantee lack of exploitation in the wild. Compared to reflected XSS, Stored XSS represents a higher real-world priority due to automated attack potential and broader victim reach. The lack of available CVSS data suggests this may be a recently disclosed or pending CVE, warranting immediate investigation by affected organizations.

An attacker with contributor-level or higher access to the WordPress site (or with ability to submit user-generated content through unvalidated forms) injects malicious JavaScript into a profile field, group description, or community post that is stored in the database. When other users, including administrators, visit the compromised profile or group page, the stored script executes in their browser context, potentially stealing session cookies, redirecting to a phishing site, or performing unauthorized actions such as creating new admin accounts. Given that ProfileGrid manages user profiles and groups, the attack surface is broad and the victim set includes all site users who interact with the affected content.