# CVE-2026-4610: Metagauss ProfileGrid Stored XSS in pm_send_message_to_author

Source: https://junglewise.ai/threats/cve-2026-4610-metagauss-profilegrid-stored-xss-in-pm-send-message-to-author  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2026-4610 · Severity: medium · CVSS 6.4 · Published 2026-06-23

The ProfileGrid plugin for WordPress, which is used to manage user profiles and community groups, contains a security flaw that allows logged-in users to inject malicious scripts into the website. These scripts can execute in the browsers of other users or administrators who view the affected pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

## Quick answers

**Is CVE-2026-4610 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4610 being exploited in the wild.

**How severe is CVE-2026-4610?** Medium severity, with a CVSS score of 6.4, published 23 June 2026.

**Which products and versions are affected?** Metagauss ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.9.2.

**Is there a fix for CVE-2026-4610?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4610 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4610?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ProfileGrid plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'pm_author_message' parameter within the pm_send_message_to_author function. Authenticated attackers with Subscriber-level permissions or higher can exploit this by submitting malicious JavaScript through the messaging feature. This script is then stored on the server and executed in the context of any user who views the page where the message is displayed. The vulnerability affects all versions up to and including 5.9.9.2, with a partial patch previously attempted in version 5.9.8.5.

## Affected products

- Metagauss ProfileGrid – User Profiles, Groups and Communities up to, and including, 5.9.9.2

## Timeline

- 2026-06-23: disclosed
- 2026-06-23: advisory

## References

- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-request.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-request.php)
- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-request.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/includes/class-profile-magic-request.php)
- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php)
- [https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php](https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/public/class-profile-magic-public.php)
- [https://plugins.trac.wordpress.org/changeset/3538301/](https://plugins.trac.wordpress.org/changeset/3538301/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/34c64a8b-32ad-4349-b593-933fc057d1a6?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/34c64a8b-32ad-4349-b593-933fc057d1a6?source=cve)