Unknown Profilegrid vulnerabilities

7 CVEs affecting Unknown Profilegrid, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-16290, published 2026-08-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-12687, published 2026-07-30. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register…
CVE-2026-16290, published 2026-08-06. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any…
CVE-2026-12688, published 2026-07-24. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The ProfileGrid WordPress plugin before 5.9.9.7 does not verify PayPal IPN notifications before granting paid group membership, allowing unauthenticated attackers to forge a payment notification and…
CVE-2026-16289, published 2026-08-03. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authenticated user such as a Subscriber to…
CVE-2026-12690, published 2026-07-24. Low severity, CVSS 3.8. EPSS: 0.3% chance of exploitation in the next 30 days. The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing…
CVE-2026-16291, published 2026-08-02. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete…
CVE-2026-12689, published 2026-07-24. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with…