/Vulnerability Library

ProfileGrid <= 5.7.8 - SQL Injection

CVE-2024-30490
Verified

Description

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 5.7.8 due to insufficient escaping on the user supplied 'search' parameter and lack of sufficient preparation on the existing SQL query.

Severity

Critical

Published Date

January 30, 2026

Template Author

shivam kamboj

CVE-2024-30490.yaml
9.5Severity

CVSS Metrics

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/profilegrid-user-profiles-groups-and-communities/profilegrid-578-unauthenticated-sql-injectionhttps://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/https://nvd.nist.gov/vuln/detail/CVE-2024-30490

Remediation Steps

Update to ProfileGrid version 5.7.9 or later.