EUVD-2026-38447
GHSA-377q-j2cj-r6x8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS still requires a victim to load the injected page (UI:R); Subscriber-level auth gates injection (PR:L); scope change reflects WordPress cross-context impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The ProfileGrid - User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.
AnalysisAI
Stored Cross-Site Scripting in the ProfileGrid WordPress plugin (all versions through 5.9.9.2) allows authenticated users with Subscriber-level access to inject persistent malicious scripts via the pm_author_message parameter in the private messaging function pm_send_message_to_author. The injected payload executes in any user's browser upon visiting the affected page, with a changed scope (S:C) meaning impact can extend to the broader WordPress session context - including potential admin account compromise. No public exploit has been identified at time of analysis, and a partial patch in version 5.9.8.5 does not fully remediate the issue, leaving sites running through 5.9.9.2 exposed.
Technical ContextAI
ProfileGrid is a WordPress community plugin by Metagauss (CPE: cpe:2.3:a:metagauss:profilegrid_-_user_profiles,_groups_and_communities) that provides user profiles, group management, and private messaging. The vulnerable code paths are in two files: class-profile-magic-public.php (lines 3211 and 3216) within the pm_send_message_to_author function, and class-profile-magic-request.php (lines 6790 and 6802). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: the pm_author_message parameter is written to persistent storage without adequate sanitization and later rendered in page output without proper output escaping. Because the payload survives server-side between injection and execution, it is more dangerous than reflected XSS - a single successful injection can target any number of subsequent visitors to the affected page.
RemediationAI
Update the ProfileGrid plugin to a version beyond 5.9.9.2 that fully addresses this vulnerability; the patch changeset is documented at https://plugins.trac.wordpress.org/changeset/3538301/ and should be cross-referenced against the installed version to confirm full remediation - the partial fix in 5.9.8.5 is explicitly insufficient per the CVE description. If an immediate update is not possible, disable the private messaging feature (pm_send_message_to_author) within the plugin's settings, or restrict Subscriber-level user registration on the site to prevent untrusted users from accessing the vulnerable endpoint; note that disabling messaging will disrupt legitimate user-to-author communication. Administrators should also audit stored messages in the database for any existing payloads that may have been injected prior to patching, as stored XSS persists even after the plugin is updated.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today