Metagauss vulnerabilities
118 CVEs and advisories name Metagauss as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-1271ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification
- CVE-2025-13416ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension
- CVE-2026-1054RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification
- CVE-2026-24380WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability
- CVE-2026-24374WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2025-15403RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
- CVE-2025-14507EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API
- CVE-2025-13610RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
- CVE-2025-63007WordPress EventPrime plugin <= 4.2.4.1 - Sensitive Data Exposure vulnerability
- CVE-2025-63006WordPress EventPrime plugin <= 4.2.4.1 - Broken Access Control vulnerability
- CVE-2025-12498EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
- CVE-2017-20208RegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection
- CVE-2025-11204RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
- CVE-2025-4957WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2025-49033WordPress ProfileGrid plugin <= 5.9.5.3 - SQL Injection vulnerability
- CVE-2025-49876WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerability
- CVE-2025-6977ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function
- CVE-2025-6586Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2025-52719WordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability
- CVE-2025-49877WordPress ProfileGrid plugin <= 5.9.5.2 - Server Side Request Forgery (SSRF) Vulnerability
- CVE-2025-47478WordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection Vulnerability
- CVE-2025-48079WordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control Vulnerability
- CVE-2025-39586WordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection Vulnerability
- CVE-2025-2836RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2025-0724ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2025-1408ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
- CVE-2025-0723ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-13526EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export
- CVE-2025-26999WordPress ProfileGrid Plugin <= 5.9.4.3 - PHP Object Injection vulnerability
- CVE-2024-13740ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure