# cve.now: Metagauss

The newest entries naming Metagauss as an affected vendor (up to 200), of 118 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-94663](https://cve.now/CVE-2026-94663.md): WordPress ProfileGrid plugin \<= 6.0.0.2 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-62061](https://cve.now/CVE-2026-62061.md): WordPress ProfileGrid plugin \<= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-82225](https://cve.now/CVE-2026-82225.md): WordPress RegistrationMagic plugin \<= 6.0.9.8 - Broken Authentication vulnerability (CVSS 7.4)
- [CVE-2026-82221](https://cve.now/CVE-2026-82221.md): WordPress RegistrationMagic plugin \<= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-73341](https://cve.now/CVE-2026-73341.md): WordPress RegistrationMagic plugin \<= 6.0.9.7 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-57697](https://cve.now/CVE-2026-57697.md): WordPress ProfileGrid plugin \<= 5.9.9.6 - Broken Authentication vulnerability (CVSS 7.5)
- [CVE-2026-13441](https://cve.now/CVE-2026-13441.md): EventPrime \<= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new\_event\_type\_background\_color' Parameter (CVSS 7.2)
- [CVE-2026-11359](https://cve.now/CVE-2026-11359.md): Memberships and User Profiles for WooCommerce \<= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation (CVSS 4.3)
- [CVE-2026-57759](https://cve.now/CVE-2026-57759.md): WordPress ProfileGrid plugin \<= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
- [CVE-2026-12158](https://cve.now/CVE-2026-12158.md): RegistrationMagic \<= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc\_assign\_user\_role\_action' Parameter (CVSS 8.8)
- [CVE-2026-12073](https://cve.now/CVE-2026-12073.md): ProfileGrid - User Profiles, Groups and Communities \<= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite (CVSS 9.8)
- [CVE-2026-9242](https://cve.now/CVE-2026-9242.md): RegistrationMagic \<= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request (CVSS 5.3)
- [CVE-2026-4610](https://cve.now/CVE-2026-4610.md): ProfileGrid \<= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content (CVSS 6.4)
- [CVE-2026-49764](https://cve.now/CVE-2026-49764.md): WordPress RegistrationMagic plugin \<= 6.0.8.6 - Broken Authentication vulnerability (CVSS 9.8)
- [CVE-2026-4609](https://cve.now/CVE-2026-4609.md): ProfileGrid \<= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining (CVSS 7.1)
- [CVE-2026-4607](https://cve.now/CVE-2026-4607.md): ProfileGrid \<= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification (CVSS 4.3)
- [CVE-2026-4608](https://cve.now/CVE-2026-4608.md): ProfileGrid \<= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter (CVSS 6.5)
- [CVE-2026-32498](https://cve.now/CVE-2026-32498.md): WordPress RegistrationMagic plugin \<= 6.0.7.6 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-25417](https://cve.now/CVE-2026-25417.md): WordPress ProfileGrid plugin \<= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-24378](https://cve.now/CVE-2026-24378.md): WordPress EventPrime plugin \<= 4.2.8.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-24373](https://cve.now/CVE-2026-24373.md): WordPress RegistrationMagic plugin \<= 6.0.7.1 - Account Takeover vulnerability (CVSS 8.1)
- [CVE-2025-69358](https://cve.now/CVE-2025-69358.md): WordPress EventPrime plugin \<= 4.2.6.0 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-25312](https://cve.now/CVE-2026-25312.md): WordPress EventPrime plugin \<= 4.2.8.3 - Payment Bypass vulnerability (CVSS 7.5)
- [CVE-2026-32385](https://cve.now/CVE-2026-32385.md): WordPress RegistrationMagic plugin \<= 6.0.7.6 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-2494](https://cve.now/CVE-2026-2494.md): ProfileGrid \<= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial (CVSS 4.3)
- [CVE-2026-2488](https://cve.now/CVE-2026-2488.md): ProfileGrid \<= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion (CVSS 4.3)
- [CVE-2026-25389](https://cve.now/CVE-2026-25389.md): WordPress EventPrime plugin \<= 4.2.8.3 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2025-14444](https://cve.now/CVE-2025-14444.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 6.0.6.9 - Unauthenticated Payment Bypass via rm\_process\_paypal\_sdk\_payment (CVSS 5.3)
- [CVE-2026-1655](https://cve.now/CVE-2026-1655.md): EventPrime \<= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event\_id' Parameter (CVSS 4.3)
- [CVE-2026-1657](https://cve.now/CVE-2026-1657.md): EventPrime \<= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep\_upload\_file\_media' AJAX Endpoint (CVSS 5.3)
- [CVE-2026-1271](https://cve.now/CVE-2026-1271.md): ProfileGrid \<= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification (CVSS 5.3)
- [CVE-2025-13416](https://cve.now/CVE-2025-13416.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension (CVSS 4.3)
- [CVE-2026-1054](https://cve.now/CVE-2026-1054.md): RegistrationMagic \<= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification (CVSS 5.3)
- [CVE-2026-24380](https://cve.now/CVE-2026-24380.md): WordPress EventPrime plugin \<= 4.2.8.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-24374](https://cve.now/CVE-2026-24374.md): WordPress RegistrationMagic plugin \<= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-15403](https://cve.now/CVE-2025-15403.md): RegistrationMagic \<= 6.0.7.1 - Unauthenticated Privilege Escalation via admin\_order (CVSS 9.8)
- [CVE-2025-14507](https://cve.now/CVE-2025-14507.md): EventPrime - Events Calendar, Bookings and Tickets \<= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API (CVSS 5.3)
- [CVE-2025-13610](https://cve.now/CVE-2025-13610.md): RegistrationMagic \<= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM\_Forms' Shortcode (CVSS 6.4)
- [CVE-2025-63007](https://cve.now/CVE-2025-63007.md): WordPress EventPrime plugin \<= 4.2.4.1 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2025-63006](https://cve.now/CVE-2025-63006.md): WordPress EventPrime plugin \<= 4.2.4.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-12498](https://cve.now/CVE-2025-12498.md): EventPrime – Events Calendar, Bookings and Tickets \<= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation (CVSS 4.3)
- [CVE-2017-20208](https://cve.now/CVE-2017-20208.md): RegistrationMagic - Custom Registration Forms \<= 3.7.9.2 - PHP Object Injection (CVSS 9.8)
- [CVE-2025-11204](https://cve.now/CVE-2025-11204.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 6.0.6.2 - Authenticated (Administrator+) SQL Injection (CVSS 7.2)
- [CVE-2025-4957](https://cve.now/CVE-2025-4957.md): WordPress ProfileGrid plugin \<= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-49033](https://cve.now/CVE-2025-49033.md): WordPress ProfileGrid plugin \<= 5.9.5.3 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-49876](https://cve.now/CVE-2025-49876.md): WordPress ProfileGrid plugin \<= 5.9.5.2 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-6977](https://cve.now/CVE-2025-6977.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm\_get\_messenger\_notification' function (CVSS 6.1)
- [CVE-2025-6586](https://cve.now/CVE-2025-6586.md): Download Plugin \<= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2)
- [CVE-2025-52719](https://cve.now/CVE-2025-52719.md): WordPress ProfileGrid plugin \<= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability (CVSS 4.3)
- [CVE-2025-49877](https://cve.now/CVE-2025-49877.md): WordPress ProfileGrid plugin \<= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9)
- [CVE-2025-47478](https://cve.now/CVE-2025-47478.md): WordPress ProfileGrid plugin \<= 5.9.5.0 - SQL Injection Vulnerability (CVSS 8.5)
- [CVE-2025-48079](https://cve.now/CVE-2025-48079.md): WordPress ProfileGrid plugin \<= 5.9.5.1 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-39586](https://cve.now/CVE-2025-39586.md): WordPress ProfileGrid plugin \<= 5.9.4.8 - SQL Injection Vulnerability (CVSS 8.5)
- [CVE-2025-2836](https://cve.now/CVE-2025-2836.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-0724](https://cve.now/CVE-2025-0724.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8)
- [CVE-2025-1408](https://cve.now/CVE-2025-1408.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management (CVSS 4.3)
- [CVE-2025-0723](https://cve.now/CVE-2025-0723.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5)
- [CVE-2024-13526](https://cve.now/CVE-2024-13526.md): EventPrime – Events Calendar, Bookings and Tickets \<= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export (CVSS 4.3)
- [CVE-2025-26999](https://cve.now/CVE-2025-26999.md): WordPress ProfileGrid Plugin \<= 5.9.4.3 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2024-13740](https://cve.now/CVE-2024-13740.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure (CVSS 4.3)
- [CVE-2024-13741](https://cve.now/CVE-2024-13741.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery (CVSS 5.4)
- [CVE-2025-25110](https://cve.now/CVE-2025-25110.md): WordPress Event Kikfyre plugin \<= 2.1.8 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-24686](https://cve.now/CVE-2025-24686.md): WordPress RegistrationMagic Plugin \<= 6.0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-12024](https://cve.now/CVE-2024-12024.md): EventPrime – Events Calendar, Bookings and Tickets \<= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name (CVSS 7.2)
- [CVE-2023-49831](https://cve.now/CVE-2023-49831.md): WordPress RegistrationMagic plugin \<= 5.2.3.0 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2024-10900](https://cve.now/CVE-2024-10900.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion (CVSS 6.5)
- [CVE-2024-10508](https://cve.now/CVE-2024-10508.md): RegistrationMagic – User Registration Plugin with Custom Registration Forms \<= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery (CVSS 9.8)
- [CVE-2024-9864](https://cve.now/CVE-2024-9864.md): EventPrime – Modern Events Calendar, Bookings and Tickets \<= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-9865](https://cve.now/CVE-2024-9865.md): EventPrime – Modern Events Calendar, Bookings and Tickets \<= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log (CVSS 6.1)
- [CVE-2024-9829](https://cve.now/CVE-2024-9829.md): Download Plugin \<= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download (CVSS 6.5)
- [CVE-2024-49273](https://cve.now/CVE-2024-49273.md): WordPress ProfileGrid plugin \<= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-47648](https://cve.now/CVE-2024-47648.md): WordPress EventPrime plugin \<= 4.0.4.5 - Open Redirection vulnerability (CVSS 4.7)
- [CVE-2024-8861](https://cve.now/CVE-2024-8861.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-8369](https://cve.now/CVE-2024-8369.md): EventPrime \<= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure (CVSS 5.3)
- [CVE-2024-6410](https://cve.now/CVE-2024-6410.md): ProfileGrid \<= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 4.3)
- [CVE-2024-6411](https://cve.now/CVE-2024-6411.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation (CVSS 8.8)
- [CVE-2023-52117](https://cve.now/CVE-2023-52117.md): WordPress ProfileGrid plugin \<= 5.6.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-31275](https://cve.now/CVE-2024-31275.md): WordPress EventPrime plugin \<= 3.3.4 - Booking Price Manipulation vulnerability (CVSS 8.2)
- [CVE-2024-5453](https://cve.now/CVE-2024-5453.md): ProfileGrid \<= 5.8.6 - Missing Authorization (CVSS 4.3)
- [CVE-2023-51544](https://cve.now/CVE-2023-51544.md): WordPress RegistrationMagic plugin \<= 5.2.5.0 - Form Submission Limit Bypass vulnerability (CVSS 5.3)
- [CVE-2023-51543](https://cve.now/CVE-2023-51543.md): WordPress RegistrationMagic plugin \<= 5.2.5.0 - IP Limit Bypass vulnerability (CVSS 5.3)
- [CVE-2024-32774](https://cve.now/CVE-2024-32774.md): WordPress ProfileGrid plugin \<= 5.8.2 - Group Members Limit Bypass vulnerability (CVSS 4.3)
- [CVE-2023-33321](https://cve.now/CVE-2023-33321.md): WordPress EventPrime plugin \<= 2.8.6 - Sensitive Data Exposure (CVSS 5.3)
- [CVE-2024-33947](https://cve.now/CVE-2024-33947.md): WordPress RegistrationMagic plugin \<= 5.3.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-3606](https://cve.now/CVE-2024-3606.md): ProfileGrid – User Profiles, Memberships, Groups and Communities \<= 5.8.3 - Missing Authorization (CVSS 4.3)
- [CVE-2023-23989](https://cve.now/CVE-2023-23989.md): WordPress RegistrationMagic plugin \<= 5.1.9.2 - Content Injection (CVSS 5.3)
- [CVE-2023-23976](https://cve.now/CVE-2023-23976.md): WordPress RegistrationMagic plugin \<= 5.1.9.2 - Arbitrary Price Change (CVSS 7.5)
- [CVE-2024-32772](https://cve.now/CVE-2024-32772.md): WordPress ProfileGrid plugin \<= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3)
- [CVE-2024-32808](https://cve.now/CVE-2024-32808.md): WordPress ProfileGrid plugin \<= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability (CVSS 5.4)
- [CVE-2024-31362](https://cve.now/CVE-2024-31362.md): WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin \<= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-1991](https://cve.now/CVE-2024-1991.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2024-1990](https://cve.now/CVE-2024-1990.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8)
- [CVE-2024-31291](https://cve.now/CVE-2024-31291.md): WordPress ProfileGrid plugin \<= 5.7.6 - IDOR on Friend Request vulnerability (CVSS 4.3)
- [CVE-2024-30513](https://cve.now/CVE-2024-30513.md): WordPress ProfileGrid plugin \<= 5.7.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2024-30491](https://cve.now/CVE-2024-30491.md): WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin \<= 5.7.8 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-30490](https://cve.now/CVE-2024-30490.md): WordPress ProfileGrid plugin \<= 5.7.8 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-30241](https://cve.now/CVE-2024-30241.md): WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin \<= 5.7.1 - Contributor+ SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-29776](https://cve.now/CVE-2024-29776.md): WordPress EventPrime plugin \<= 3.3.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-2951](https://cve.now/CVE-2024-2951.md): WordPress RegistrationMagic plugin \<= 5.3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-24832](https://cve.now/CVE-2024-24832.md): WordPress EventPrime plugin \<= 3.3.9 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2024-25935](https://cve.now/CVE-2024-25935.md): WordPress RegistrationMagic plugin \<= 5.2.5.9 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-29113](https://cve.now/CVE-2024-29113.md): WordPress RegistrationMagic plugin \<= 5.2.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-1126](https://cve.now/CVE-2024-1126.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval (CVSS 4.3)
- [CVE-2024-1321](https://cve.now/CVE-2024-1321.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.2 - Unauthenticated Booking Payment Bypass (CVSS 5.3)
- [CVE-2024-1127](https://cve.now/CVE-2024-1127.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export (CVSS 4.3)
- [CVE-2024-1125](https://cve.now/CVE-2024-1125.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 5.4)
- [CVE-2024-1320](https://cve.now/CVE-2024-1320.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.5)
- [CVE-2024-1123](https://cve.now/CVE-2024-1123.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite (CVSS 6.5)
- [CVE-2024-1124](https://cve.now/CVE-2024-1124.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending (CVSS 4.3)
- [CVE-2023-51509](https://cve.now/CVE-2023-51509.md): WordPress RegistrationMagic Plugin \<= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-3404](https://cve.now/CVE-2023-3404.md): ProfileGrid \<= 5.5.0 - Hardcoded Encryption Key (CVSS 4.9)
- [CVE-2023-3403](https://cve.now/CVE-2023-3403.md): ProfileGrid \<= 5.5.1 - Missing Authorization to User Import (CVSS 5.4)
- [CVE-2023-3714](https://cve.now/CVE-2023-3714.md): ProfileGrid \<= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation (CVSS 7.5)
- [CVE-2023-3713](https://cve.now/CVE-2023-3713.md): ProfileGrid \<= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update (CVSS 8.8)
- [CVE-2022-38062](https://cve.now/CVE-2022-38062.md): WordPress Download Theme Plugin \<= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-36345](https://cve.now/CVE-2022-36345.md): WordPress Download Plugin Plugin \<= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2023-2548](https://cve.now/CVE-2023-2548.md): RegistrationMagic \<= 5.2.0.5 - Authenticated (Admin+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 6.6)
- [CVE-2023-2499](https://cve.now/CVE-2023-2499.md): RegistrationMagic \<= 5.2.1.0 - Authentication Bypass (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/metagauss
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.