CVE-2019-15873: Metagauss Profilegrid

High severity, CVSS 8.8. EPSS: 3.9% chance of exploitation in the next 30 days.

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.

Affected products

• Metagauss Profilegrid: before 2.8.6 (fixed in 2.8.6)

Published 2019-09-03. Last modified 2026-06-17.