CVE-2026-4610 Overview
CVE-2026-4610 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The flaw resides in the pm_send_message_to_author function, which fails to properly sanitize the pm_author_message parameter before storing and rendering it. All plugin versions up to and including 5.9.9.2 are affected. Authenticated users with Subscriber-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor who loads the affected page. The vulnerability was partially patched in version 5.9.8.5.
Critical Impact
Authenticated attackers with minimal Subscriber-level privileges can persist arbitrary JavaScript on WordPress sites running ProfileGrid, enabling session theft, administrative account compromise, and drive-by client-side attacks against any visitor.
Affected Products
- ProfileGrid – User Profiles, Groups and Communities plugin for WordPress (all versions through 5.9.9.2)
- WordPress sites permitting Subscriber-level registration with ProfileGrid installed
- Versions prior to 5.9.8.5 (unpatched); 5.9.8.5 through 5.9.9.2 (partially patched)
Discovery Timeline
- 2026-06-23 - CVE-2026-4610 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-4610
Vulnerability Analysis
The vulnerability stems from insufficient input sanitization and output escaping inside the pm_send_message_to_author handler in ProfileGrid. The plugin accepts a user-supplied pm_author_message value, stores it, and later renders it in a page context without escaping HTML or JavaScript. This pattern allows an authenticated attacker to embed <script> tags or event-handler payloads that execute when any user, including administrators, loads the rendered page. Because the payload persists server-side, every subsequent page view becomes an attack opportunity. Code paths involved are visible in the upstream source at class-profile-magic-request.php (lines 6790 and 6802) and class-profile-magic-public.php (lines 3211 and 3216). The scope is changed (S:C), meaning the injected script can affect resources beyond the vulnerable component, such as the WordPress admin session.
Root Cause
The plugin trusts the pm_author_message request parameter without applying WordPress sanitization helpers such as wp_kses_post(), sanitize_text_field(), or output-time escaping via esc_html() and esc_attr(). Both the storage and rendering paths lack adequate filtering, producing a classic stored XSS sink.
Attack Vector
An attacker registers or logs into a Subscriber account, then submits a crafted message through the ProfileGrid author-messaging feature with JavaScript embedded in the pm_author_message parameter. The payload is written to the database and reflected unescaped when the target page is rendered, executing in the victim's browser under the site's origin. No user interaction beyond visiting an affected page is required.
The vulnerability manifests in the pm_send_message_to_author function. See the Wordfence Vulnerability Report and the WordPress ProfileGrid Code Review for technical details.
Detection Methods for CVE-2026-4610
Indicators of Compromise
- Unexpected <script>, onerror=, onload=, or javascript: strings stored in ProfileGrid message records within the WordPress database.
- POST requests to admin-ajax.php invoking the pm_send_message_to_author action with HTML or JavaScript payloads in pm_author_message.
- Outbound browser requests from authenticated admin sessions to attacker-controlled domains shortly after viewing ProfileGrid content.
- Newly created administrator accounts or modified user roles following Subscriber-level activity.
Detection Strategies
- Query the wp_postmeta and ProfileGrid message tables for HTML or script tags in stored message fields.
- Inspect web server access logs for POST bodies containing pm_author_message with encoded or raw script payloads.
- Compare the installed plugin version against 5.9.9.2 and below using WP-CLI or the WordPress admin Plugins screen.
Monitoring Recommendations
- Enable a Web Application Firewall (WAF) ruleset that flags XSS payloads on requests targeting ProfileGrid endpoints.
- Monitor administrator session activity for anomalous DOM events or cookie access initiated from ProfileGrid-rendered pages.
- Alert on creation of new privileged WordPress accounts or plugin/theme file modifications outside change windows.
How to Mitigate CVE-2026-4610
Immediate Actions Required
- Update the ProfileGrid – User Profiles, Groups and Communities plugin to the latest available release beyond 5.9.9.2 once the vendor publishes a full fix.
- Audit existing ProfileGrid message data for previously injected scripts and purge malicious entries.
- Review WordPress user accounts and remove unauthorized Subscriber or higher-privileged accounts created during the exposure window.
- Force a password reset for administrators and rotate session tokens and secret keys in wp-config.php.
Patch Information
The vulnerability was partially patched in ProfileGrid version 5.9.8.5 but remained exploitable through version 5.9.9.2. Site operators must track the WordPress plugin changeset 3538301 and apply releases newer than 5.9.9.2 once published. Verify both the storage path in class-profile-magic-request.php and the rendering path in class-profile-magic-public.php are remediated.
Workarounds
- Disable the ProfileGrid plugin until a fully patched release is installed if author messaging is not business-critical.
- Restrict user registration to trusted users and require manual approval for Subscriber accounts.
- Deploy a WAF rule blocking requests to the pm_send_message_to_author action where pm_author_message contains <script, onerror=, onload=, or javascript: tokens.
- Apply a strict Content Security Policy (CSP) that disallows inline scripts to reduce stored XSS impact.
# Example WP-CLI commands to identify vulnerable installs and disable the plugin
wp plugin get profilegrid-user-profiles-groups-and-communities --field=version
wp plugin deactivate profilegrid-user-profiles-groups-and-communities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
