CVE-2025-4957: WordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability
Published Sep 26, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Reflected XSS.This issue affects ProfileGrid : from n/a through <= 5.9.5.7.
Affected Software
1 affected component
Metagauss ProfileGrid<=5.9.5.7
Remediation
Information
Update the WordPress ProfileGrid plugin to the latest available version (at least 5.9.5.8).
Event History
Sep 26, 2025
CVE Published
via MITRE·08:31 AM
Data Sourced
via MITRE·08:31 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-4957?
The severity of CVE-2025-4957 is considered medium due to its ability to allow reflected cross-site scripting (XSS) attacks.
2
How do I fix CVE-2025-4957?
To fix CVE-2025-4957, update Metagauss ProfileGrid to the latest version beyond 5.9.5.7.
3
What versions of ProfileGrid are affected by CVE-2025-4957?
CVE-2025-4957 affects Metagauss ProfileGrid versions from n/a to 5.9.5.7.
4
What type of vulnerability is CVE-2025-4957?
CVE-2025-4957 is classified as a Cross-site Scripting (XSS) vulnerability.
5
Who is affected by CVE-2025-4957?
Users of Metagauss ProfileGrid and WordPress ProfileGrid up to version 5.9.5.7 are affected by CVE-2025-4957.