ProfileGrid EUVD-2026-38447

Exploitation requires the attacker to hold at minimum a Subscriber-level WordPress account on the target site, meaning open user registration must be enabled or the attacker must possess a low-privilege credential obtained by other means. The specific vulnerable entry point is the pm_author_message parameter passed to the pm_send_message_to_author function - the private messaging feature of ProfileGrid must be in use. Exploitation is limited by: the authenticated access requirement (PR:L per CVSS vector); the need for a victim user to subsequently view or load the page containing the stored payload; and sites running version 5.9.8.5 through 5.9.9.2 which have only partial mitigation. Sites with closed user registration or that do not expose ProfileGrid's private messaging feature to untrusted users face significantly lower realistic risk.

The NVD-provided CVSS 6.4 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) highlights several meaningful signals: the attack is network-reachable with low complexity, requires only Subscriber-level credentials (a low but non-zero barrier), and carries a changed scope that signals the potential for cross-context impact such as WordPress admin session hijacking. The S:C rating is the most consequential element - a successful XSS against an administrator who views a stored message can lead to full site compromise, far exceeding the base C:L/I:L ratings in practice. No KEV listing is present, and no public exploit code has been identified, reducing immediate exploitation pressure. EPSS data was not provided, so exploitation probability cannot be measured quantitatively. The partial patch in 5.9.8.5 is a significant complicating factor: sites between 5.9.8.5 and 5.9.9.2 may have incomplete protection and cannot assume they are safe solely based on their version. Real-world risk is moderate-to-high for WordPress sites with open user registration due to the low privilege requirement.

An attacker registers a free Subscriber account on a WordPress site with ProfileGrid installed and open user registration enabled, then sends a private message to an author containing a crafted XSS payload in the message body field. When an administrator or any authenticated user subsequently views the message thread or an affected page, the stored script silently executes in their browser - enabling the attacker to steal the victim's session cookie, capture credentials, or issue authenticated WordPress API requests to create a rogue admin account.