What is the CVSS score of CVE-2026-25417?

CVE-2026-25417 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Profilegrid are affected by CVE-2026-25417?

CVE-2026-25417 presents notable security risk, a cross-site scripting vulnerability rated CVSS 6.5. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

How to fix or mitigate CVE-2026-25417?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Profilegrid CVE-2026-25417

EUVD-2026-15723 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-rfqc-24wx-qfqq

XSS Profilegrid

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15723

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Stored XSS.This issue affects ProfileGrid : from n/a through <= 5.9.8.1.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Metagauss ProfileGrid WordPress plugin through version 5.9.8.1, allowing attackers to inject malicious scripts that persist in the database and execute in the browsers of other users. The vulnerability affects all versions of ProfileGrid up to and including 5.9.8.1, enabling attackers with appropriate access to compromise user sessions, steal credentials, or perform actions on behalf of victims. While no CVSS score or EPSS data is currently available, the Stored XSS classification (CWE-79) combined with active reporting from security researchers indicates this is a legitimate and actionable threat.

Technical ContextAI

The vulnerability stems from improper neutralization of user input during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The ProfileGrid plugin, identified via CPE (cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:*:*:*), is a WordPress plugin designed for user profiles, groups, and community management. The root cause is the failure to properly sanitize and escape user-supplied data before rendering it in HTML contexts, allowing attackers to inject arbitrary JavaScript code that becomes part of the stored content. When other users view pages containing the injected payload, the malicious script executes in their browsers with the privileges of the authenticated session, making this a Stored XSS rather than merely Reflected XSS.

RemediationAI

The primary remediation is to upgrade the ProfileGrid plugin to a version later than 5.9.8.1 as soon as a patched release is available from Metagauss or through the WordPress plugin repository. Organizations should check for available updates in their WordPress admin dashboard under Plugins > Updates, or visit the official ProfileGrid plugin page for the latest version. Until a patch is available, implementers should enforce Content Security Policy (CSP) headers with script-src restrictions to mitigate inline script injection, apply Web Application Firewall (WAF) rules to detect and block known XSS payloads, restrict plugin functionality to trusted administrators only, and consider temporarily disabling user-facing ProfileGrid features if risk tolerance is low. Input validation and output encoding should be verified at the application level if custom modifications exist. For additional guidance, refer to the Patchstack vulnerability database entry and consult the official Metagauss security advisories.