Log in Start free

Metagauss

Products

ProductCVEsExploitedLatest
ProfileGrid25–Oct 9, 2026
ProfileGrid – User Profiles, Groups and Communities25–Jun 30, 2026
RegistrationMagic18–Aug 31, 2026
EventPrime – Events Calendar, Bookings and Tickets17–Jul 9, 2026
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login14–Jul 1, 2026
EventPrime12–Mar 25, 2026
Download Plugin3–Jul 4, 2025
Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration1–Jul 9, 2026
Event Kikfyre1–Feb 7, 2025
Download Theme1–Jul 17, 2023

Exploited and recent CVEs

  • CVE-2026-94663 High 8.5 WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability 0.2%
  • CVE-2026-62061 Medium 5.3 WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability 0.2%
  • CVE-2026-82225 High 7.4 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability 0.4%
  • CVE-2026-82221 High 7.1 WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-73341 Critical 9.8 WordPress RegistrationMagic plugin <= 6.0.9.7 - PHP Object Injection vulnerability 0.6%
  • CVE-2026-57697 High 7.5 WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability 0.5%
  • CVE-2026-13441 High 7.2 EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter 0.4%
  • CVE-2026-11359 Medium 4.3 Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation 0.3%
  • CVE-2026-57759 High 8.8 WordPress ProfileGrid plugin <= 6.0.0.2 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2026-12158 High 8.8 RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter 0.3%
  • CVE-2026-12073 Critical 9.8 ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite 0.5%
  • CVE-2026-9242 Medium 5.3 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request 0.3%
  • CVE-2026-4610 Medium 6.4 ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content 0.3%
  • CVE-2026-49764 Critical 9.8 WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability 0.4%
  • CVE-2026-4609 High 7.1 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining 0.2%
  • CVE-2026-4607 Medium 4.3 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification 0.2%
  • CVE-2026-4608 Medium 6.5 ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter 0.3%
  • CVE-2026-32498 High 7.5 WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability 0.3%
  • CVE-2026-25417 Medium 6.5 WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-24378 Critical 9.8 WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability 0.5%
  • CVE-2026-24373 High 8.1 WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability 0.4%
  • CVE-2025-69358 High 7.5 WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability 0.3%
  • CVE-2026-25312 High 7.5 WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability 0.2%
  • CVE-2026-32385 Medium 5.4 WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability 0.2%
  • CVE-2026-2494 Medium 4.3 ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial 0.2%
  • CVE-2026-2488 Medium 4.3 ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion 0.2%
  • CVE-2026-25389 Medium 5.3 WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2025-14444 Medium 5.3 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment 0.2%
  • CVE-2026-1655 Medium 4.3 EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter 0.3%
  • CVE-2026-1657 Medium 5.3 EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint 0.4%