Vulnerability history

Subscriber+ Arbitrary Notification Deletion vulnerability

Unauthenticated Privilege Escalation vulnerability

Unauthenticated Payment Bypass and Forced Group Membership vulnerability

Subscriber+ Cross-User Private Message Thread Deletion and Tampering vulnerability

Subscriber+ Premium License Tampering vulnerability

Broken Authentication vulnerability

Cross Site Request Forgery (CSRF) vulnerability

User Profiles, Groups and Communities plugin <= 5.9.9.5 - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining vulnerability

Authenticated (Subscriber+) SQL Injection vulnerability

Missing Authorization to Authenticated (Subscriber+) Group Settings Modification vulnerability

Cross Site Scripting (XSS) vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion vulnerability

Cross-Site Request Forgery to Group Membership Request Approval/Denial vulnerability

Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification vulnerability

WordPress ProfileGrid - User Profiles, Groups and Communities plugin <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension vulnerability

Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management vulnerability

Authenticated (Subscriber+) PHP Object Injection vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

SQL Injection vulnerability

Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function vulnerability

SQL Injection vulnerability

Full Path Disclosure (FPD) Vulnerability

Server Side Request Forgery (SSRF) Vulnerability

Broken Access Control Vulnerability

SQL Injection Vulnerability

SQL Injection Vulnerability

Authenticated (Subscriber+) SQL Injection vulnerability

PHP Object Injection vulnerability

Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure vulnerability

Authenticated (Subscriber+) Limited Server-Side Request Forgery vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

Authenticated Privilege Escalation vulnerability

Broken Access Control vulnerability

Missing Authorization vulnerability

Insecure Direct Object Reference (IDOR) vulnerability

Group Members Limit Bypass vulnerability

Insecure Direct Object References (IDOR) vulnerability

Missing Authorization vulnerability

Cross Site Request Forgery (CSRF) vulnerability

IDOR on Friend Request vulnerability

Insecure Direct Object References (IDOR) vulnerability

SQL Injection vulnerability

SQL Injection vulnerability

Contributor+ SQL Injection vulnerability

Broken Access Control vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Authenticated (Subscriber+) Arbitrary Option Update vulnerability

Hardcoded Encryption Key vulnerability

Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation vulnerability

Missing Authorization to User Import vulnerability

Broken Access Control vulnerability

Subscriber+ Arbitrary Password Reset vulnerability

Auth. CSV Injection vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Code Execution vulnerability

Reflected Cross Site Scripting