The vulnerability resides in the pm_get_messenger_notification function of the ProfileGrid plugin for WordPress. User input is not properly sanitized or escaped before being reflected back to the browser. This flaw, classified as CWE‑79, allows an unauthenticated attacker to embed malicious scripts in a crafted link. When a logged‑in user follows that link, the script runs in the context of the victim’s account, enabling session hijacking, data theft, or defacement.

All installations of the metagauss ProfileGrid – User Profiles, Groups and Communities plugin for WordPress version 5.9.5.4 or earlier are affected. The issue exists across all WordPress sites that support this plugin version.

The CVSS score of 6.1 indicates significant impact with medium exploitability. The EPSS score is below 1 %, implying that while the vulnerability exists, it is considered a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. An attacker can gain access without authentication and must solely rely on persuading a logged‑in user to click a malicious link, which is a feasible social‑engineering scenario on most public sites.