Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Metagauss — Vulnerabilities & Security Advisories 113

Browse all 113 CVE security advisories affecting Metagauss. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Metagauss operates as a cybersecurity firm specializing in automated penetration testing and vulnerability assessment services. Its primary offering involves scanning enterprise networks to identify security weaknesses, providing clients with actionable reports on potential entry points. Historically, the company’s infrastructure and associated platforms have been linked to a significant number of Common Vulnerabilities and Exposures, totaling 101 recorded CVEs. These vulnerabilities predominantly stem from common web application flaws, including remote code execution, cross-site scripting, and improper access control mechanisms. While specific major public incidents involving data breaches directly attributed to Metagauss are not widely documented in mainstream news, the high volume of CVEs suggests systemic issues in their software development lifecycle or third-party dependencies. Security researchers often highlight these findings as cautionary examples of how automated security tools themselves can become attack vectors if not rigorously maintained and patched against known exploit patterns.

CVE IDTitleCVSSSeverityPublished
CVE-2026-57697 WordPress ProfileGrid plugin <= 5.9.9.6 - Broken Authentication vulnerability — ProfileGridCWE-288 7.5 High2026-07-13
CVE-2026-13441 EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter — EventPrime – Events Calendar, Bookings and TicketsCWE-79 7.2 High2026-07-09
CVE-2026-11359 Memberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation — Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce IntegrationCWE-862 4.3 Medium2026-07-09
CVE-2026-57759 WordPress ProfileGrid plugin <= 5.9.9.7 - CSRF to Account Takeover vulnerability — ProfileGridCWE-352 8.8 High2026-07-02
CVE-2026-12158 RegistrationMagic <= 6.0.9.1 - Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter — RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User LoginCWE-352 8.8 High2026-07-01
CVE-2026-12073 ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite — ProfileGrid – User Profiles, Groups and CommunitiesCWE-639 9.8 Critical2026-06-30
CVE-2026-9242 RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request — RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User LoginCWE-345 5.3 Medium2026-06-27
CVE-2026-4610 ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content — ProfileGrid – User Profiles, Groups and CommunitiesCWE-79 6.4 Medium2026-06-23
CVE-2026-49764 WordPress RegistrationMagic plugin <= 6.0.8.6 - Broken Authentication vulnerability — RegistrationMagicCWE-288 9.8 Critical2026-06-15
CVE-2026-4607 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification — ProfileGrid – User Profiles, Groups and CommunitiesCWE-862 4.3 Medium2026-05-13
CVE-2026-4609 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining — ProfileGrid – User Profiles, Groups and CommunitiesCWE-862 7.1 High2026-05-13
CVE-2026-4608 ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter — ProfileGrid – User Profiles, Groups and CommunitiesCWE-89 6.5 Medium2026-05-13
CVE-2026-32498 WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability — RegistrationMagicCWE-862 7.5 High2026-03-25
CVE-2026-25417 WordPress ProfileGrid plugin <= 5.9.8.1 - Cross Site Scripting (XSS) vulnerability — ProfileGridCWE-79 6.5 Medium2026-03-25
CVE-2026-24378 WordPress EventPrime plugin <= 4.2.8.0 - PHP Object Injection vulnerability — EventPrimeCWE-502 9.8 Critical2026-03-25
CVE-2026-24373 WordPress RegistrationMagic plugin <= 6.0.7.1 - Account Takeover vulnerability — RegistrationMagicCWE-266 8.1 High2026-03-25
CVE-2025-69358 WordPress EventPrime plugin <= 4.2.6.0 - Broken Access Control vulnerability — EventPrimeCWE-862 7.5 High2026-03-25
CVE-2026-25312 WordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability — EventPrimeCWE-862 7.5 High2026-03-19
CVE-2026-32385 WordPress RegistrationMagic plugin <= 6.0.7.6 - Broken Access Control vulnerability — RegistrationMagicCWE-862 5.4 Medium2026-03-13
CVE-2026-2488 ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion — ProfileGrid – User Profiles, Groups and CommunitiesCWE-862 4.3 Medium2026-03-07
CVE-2026-2494 ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial — ProfileGrid – User Profiles, Groups and CommunitiesCWE-352 4.3 Medium2026-03-07
CVE-2026-25389 WordPress EventPrime plugin <= 4.2.8.3 - Sensitive Data Exposure vulnerability — EventPrimeCWE-497 5.3 Medium2026-02-19
CVE-2025-14444 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment — RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User LoginCWE-345 5.3 Medium2026-02-18
CVE-2026-1655 EventPrime <= 4.2.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter — EventPrime – Events Calendar, Bookings and TicketsCWE-862 4.3 Medium2026-02-18
CVE-2026-1657 EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint — EventPrime – Events Calendar, Bookings and TicketsCWE-862 5.3 Medium2026-02-17
CVE-2026-1271 ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification — ProfileGrid – User Profiles, Groups and CommunitiesCWE-639 5.3 Medium2026-02-05
CVE-2025-13416 ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension — ProfileGrid – User Profiles, Groups and CommunitiesCWE-862 4.3 Medium2026-02-05
CVE-2026-1054 RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification — RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User LoginCWE-862 5.3 Medium2026-01-28
CVE-2026-24380 WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability — EventPrimeCWE-862 5.3 Medium2026-01-22
CVE-2026-24374 WordPress RegistrationMagic plugin <= 6.0.6.9 - Cross Site Request Forgery (CSRF) vulnerability — RegistrationMagicCWE-352 5.4 Medium2026-01-22

This page lists every published CVE security advisory associated with Metagauss. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.