https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:02:26.016309+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-331165 EUVD-2026-331165 2026-10-02T10:02:26.018558+00:00 EUVD-2026-331165 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4610 fkie_cve-2026-4610 2026-10-02T10:02:26.018588+00:00

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.

 https://cve.radiocsirt.org/vuln/ghsa-377q-j2cj-r6x8 GHSA-377q-j2cj-r6x8 2026-10-02T10:02:26.018623+00:00

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pm_author_message' parameter in the pm_send_message_to_author function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 5.9.8.5.