Junglewise Threat Intelligence

CVE-2026-4610: Metagauss ProfileGrid Stored XSS in pm_send_message_to_author

CVE-2026-4610 · Severity: medium · CVSS 6.4 · Published 2026-06-23

Technologies: Metagauss ProfileGrid – User Profiles, Groups and Communities. Vendors: Metagauss.

Executive brief

The ProfileGrid plugin for WordPress, which is used to manage user profiles and community groups, contains a security flaw that allows logged-in users to inject malicious scripts into the website. These scripts can execute in the browsers of other users or administrators who view the affected pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technical details

The ProfileGrid plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'pm_author_message' parameter within the pm_send_message_to_author function. Authenticated attackers with Subscriber-level permissions or higher can exploit this by submitting malicious JavaScript through the messaging feature. This script is then stored on the server and executed in the context of any user who views the page where the message is displayed. The vulnerability affects all versions up to and including 5.9.9.2, with a partial patch previously attempted in version 5.9.8.5.

Affected products

  • Metagauss ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.9.2

Timeline

  • 2026-06-23: disclosed
  • 2026-06-23: advisory

References