CVE-2026-4610

Name of the Vulnerable Software and Affected Versions ProfileGrid versions prior to 5.9.9.3

Description The ProfileGrid plugin for WordPress contains a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access or higher can inject arbitrary web scripts through the pm author message parameter in the pm send message to author() function. These scripts execute whenever a user accesses a page where the content was injected.

Recommendations Update to a version later than 5.9.9.2. As a temporary workaround, restrict access to the pm send message to author() function or sanitize the pm author message parameter to prevent script injection.