PT-2025-29690 · WordPress · Profilegrid – User Profiles

Kenneth Billones

·

Published

2025-07-16

·

Updated

2025-07-16

·

CVE-2025-6977

CVSS v3.1
6.1
VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions:

ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions through 5.9.5.4

Description:

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which can execute if a logged-in user is tricked into performing an action, such as clicking a link. The `pm get messenger notification` function is the point of entry for this issue.

Recommendations:

Update ProfileGrid – User Profiles, Groups and Communities plugin for WordPress to a version later than 5.9.5.4.

Fix

XSS

Weakness Enumeration

Related Identifiers

CVE-2025-6977

Affected Products

Profilegrid – User Profiles