CVE-2026-4610: ProfileGrid WordPress Plugin Stored XSS Vulnerability (CVSS 6.4)

Technical summary

CVE-2026-4610 is a Stored Cross-Site Scripting (XSS) vulnerability in the ProfileGrid plugin's pm_send_message_to_author function. The 'pm_author_message' parameter fails to properly sanitize user input and does not adequately escape output when rendering stored content. This allows authenticated attackers to inject arbitrary JavaScript that persists in the database and executes whenever the affected page is accessed, affecting all users who view that content. The vulnerability requires authenticated access but only needs Subscriber-level privileges, the lowest authenticated role in WordPress.

Business impact

This vulnerability enables persistent injection of malicious scripts across your WordPress site, affecting any visitor to compromised pages. Attackers with subscriber-level access or above could exfiltrate user data, perform unauthorized actions on behalf of administrators, or redirect users to phishing sites. For sites using ProfileGrid for community engagement, this directly threatens user trust and data integrity. Multi-tenant or community-driven sites face elevated risk due to the broader user base with posting capabilities.

Affected systems

ProfileGrid – User Profiles, Groups and Communities plugin for WordPress in all versions up to and including 5.9.9.2. Version 5.9.8.5 received a partial patch but does not fully resolve the issue. Sites running any version in this range remain at least partially vulnerable.

Exploitability

Exploitability is straightforward for authenticated attackers with subscriber-level access or higher—a role commonly assigned to regular community members. No special network configuration or additional vulnerabilities are required; the attack is network-accessible and requires no user interaction beyond visiting an affected page. The bar for initial access is low on community-focused installations, making this a practical risk in real-world environments.

Remediation

Update the ProfileGrid plugin to a patched version beyond 5.9.9.2 when available. If your version is 5.9.8.5, upgrade to the latest release, as that version only partially mitigates the issue. Review your plugin update frequency and enable automatic updates where possible. In the interim, audit user roles and restrict Subscriber-level publishing permissions to trusted users only.

Patch guidance

Check the official ProfileGrid plugin repository or vendor advisory for the latest available version and patch release notes. Update through the WordPress plugin dashboard (Plugins > Installed Plugins > ProfileGrid) or via WP-CLI. Verify against the vendor advisory to confirm the version you're upgrading to fully resolves CVE-2026-4610. After patching, clear any cached versions and test community features to ensure functionality is preserved.

Detection guidance

Monitor WordPress audit logs for message submissions via the pm_send_message_to_author function, particularly those containing script tags, JavaScript protocols, or HTML entities. Review stored messages in the ProfileGrid database tables for suspicious content, especially those containing <script>, on*, or encoded payloads. Enable WordPress security plugins to detect and block XSS payloads in real time. Check page load behavior and network requests from community pages for unexpected third-party scripts.

Why prioritize this

A CVSS 6.4 Medium-severity vulnerability affecting a community management plugin warrants prompt attention due to the combination of stored persistence, low authentication barriers, and site-wide impact. While not critical, the ease of exploitation and potential for user data compromise make this a near-term priority, especially for public or multi-tenant WordPress installations. It does not carry critical severity, but remediation should occur within your standard patching window for Medium-risk issues.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a Medium-severity issue driven by low attack complexity, low privilege requirements (authenticated but Subscriber level), network accessibility, and cross-site impact (C:L/I:L/A:N). The stored nature of the XSS (persistent) and broad site reach elevate concern beyond typical reflected XSS, but lack of confidentiality or availability impact prevents a Critical rating. Community-driven sites should weight this toward the higher end of Medium priority.

Frequently asked questions