Metagauss vulnerabilities
118 CVEs and advisories name Metagauss as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-94663WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability
- CVE-2026-62061WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-82225WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
- CVE-2026-82221WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-73341WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability
- CVE-2026-57697WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability
- CVE-2026-13441EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
- CVE-2026-11359Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation
- CVE-2026-57759WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-12158RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter
- CVE-2026-12073ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite
- CVE-2026-9242RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request
- CVE-2026-4610ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content
- CVE-2026-49764WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability
- CVE-2026-4609ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining
- CVE-2026-4607ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification
- CVE-2026-4608ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
- CVE-2026-32498WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability
- CVE-2026-25417WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-24378WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability
- CVE-2026-24373WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability
- CVE-2025-69358WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability
- CVE-2026-25312WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability
- CVE-2026-32385WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability
- CVE-2026-2494ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial
- CVE-2026-2488ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
- CVE-2026-25389WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability
- CVE-2025-14444RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment
- CVE-2026-1655EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter
- CVE-2026-1657EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint