https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T15:49:22.079132+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-12689 CVE-2026-12689 — ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization 2026-10-12T15:49:22.095010+00:00

Affected: Unknown ProfileGrid

The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata of, and mark as read other users' private message threads.