ProfileGrid – User Profiles, Groups and Communities

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. A declining trend compresses what a buyer would pay.

1. ★★★★★ Roland

   3mo ago

   As our platform architecture slowly approaches a stable and coherent form, I find myself increasingly grateful for the flexibility and possibilities this plugin has offered me along the way. What began as a technical integration gradually became an important part of shaping the human structure of the planed community space. The staff, the support team has always been present with patience, professionalism, and care. Many questions, experiments, adjustments, and difficult implementation moments became manageable through their responsiveness and openness. Building a platform centered around human presence and meaningful interaction requires tools that allow freedom, adaptability, and continuity. ProfileGrid gave me exactly that. My sincere gratitude to the entire team for the work, thought, and support behind this project.

   Read on wp.org ↗
2. ★★★★★ vlrrml

   5mo ago

   A modern plugin effectively managing user profile and social communities. Still exploring all its rich features but it looks really great! I’m really fond of it. It has great potentials and for a small educational project like mine it is affordable. The technical support is friendly and prompt in replying to questions, which makes easy for users to find the way to the multiple features available with ProfileGrid: excellent, well done! This topic was modified 2 months, 3 weeks ago by vlrrml. This topic was modified 2 months, 3 weeks ago by vlrrml.

   Read on wp.org ↗
3. ★★★★★ tdcktz

   8mo ago

   This plugin is feature-rich; I really like it and am very grateful. However, when I visit “My Profile” (/myprofile/?uid=1), my page can load and be accessed, but I can’t scroll or properly display the content below. I’m not sure what the reason is—could you help me take a look? Thanks again. Additional information: 1. The theme I’m currently using is Heropress developed by Speciatheme. 2. Accessing on mobile devices works fine. 3. WordPress, the theme, and the plugin are all updated to the latest versions.

   Read on wp.org ↗
4. ★★★★★ Ignazio Mazzoli

   9mo ago

   Profile grid è un ottimo programma per avere l’anagrafe degli autori e sostenitori del giornale UNOeTRE.it. E’ funzionale e si aggiorna con facilità. Raccoglie tutti i dati indispensabili con foto e biografie. This topic was modified 7 months, 1 week ago by Ignazio Mazzoli.

   Read on wp.org ↗
5. ★★★★★ kazuki1981

   10mo ago

   They responded very quickly and provided excellent support. Thanks!

   Read on wp.org ↗
6. ★★★★★ Guido Cappellini

   11mo ago

   Just a few minor issues with data display, which were resolved the following day.I think it’s a really good solution for managing user groups; simple, yet comprehensive and effective.

   Read on wp.org ↗
7. ★★★★★ Michael

   1.0y ago

   They provided support promptly, and their suggestion was effective the first time.

   Read on wp.org ↗
8. ★★★★★ steveck722

   1.1y ago

   I chose ProfileGrid for my site because of all it offers, at a reasonable price. Thank you for the great work on PG!

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.0.0.0 Fixed: Hardened ProfileGrid REST API authorization for high-risk user, group, and membership actions. Fixed: Prevented unauthorized REST access to user, group member, and membership request data. Fixed: Secured group mem 6.0.0.0
2. — Version 5.9.9.9 Added: Security improvements. 5.9.9.9
3. — Version 5.9.9.8 Added: Security improvements. 5.9.9.8
4. — Version 5.9.9.7 Added: Security improvements 5.9.9.7
5. — Version 5.9.9.6 Added: Security improvements Added: Minor UI changes 5.9.9.6
6. — Version 5.9.9.5 Minor UI fixes. Multiple bug fixes and improvements. 5.9.9.5

63 disclosed vulnerabilities on record for this plugin, 1 still affects the current version.

1. Medium · 4.3 ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
   2026-08-02 CVE-2026-16291 Authorization Bypass Through User-Controlled Key Affects < 5.9.9.8 Patched in 5.9.9.8
2. Medium · 5.3 ProfileGrid <= 5.0.0.0 - Missing Authorization ↗
   2026-07-30 CVE-2026-16290 Missing Authorization Affects <= 5.0.0.0 Patched in 6.0.0.0
3. Medium · 4.3 ProfileGrid <= 5.0.0.0 - Missing Authorization ↗
   2026-07-24 CVE-2026-16289 Missing Authorization Affects <= 5.0.0.0 Patched in 6.0.0.0
4. Medium · 6.5 ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Unauthenticated Group Registration Bypass ↗
   2026-07-10 CVE-2026-12687 Improper Input Validation Affects < 5.9.9.8 Patched in 5.9.9.8
5. Critical · 9.8 ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset ↗
   2026-07-08 CVE-2026-57697 Weak Password Requirements Affects <= 5.9.9.6 Patched in 5.9.9.7
6. Medium · 4.3 ProfileGrid <= 5.9.9.6 - Missing Authorization ↗
   2026-07-03 CVE-2026-12689 Missing Authorization Affects <= 5.9.9.6 Patched in 5.9.9.7
7. Medium · 4.3 ProfileGrid <= 5.9.9.6 - Missing Authorization ↗
   2026-07-03 CVE-2026-12690 Missing Authorization Affects <= 5.9.9.6 Patched in 5.9.9.7
8. Medium · 5.3 ProfileGrid <= 5.9.9.6 - Unauthenticated Payment Bypass ↗
   2026-07-03 CVE-2026-12688 Improper Access Control Affects <= 5.9.9.6 Patched in 5.9.9.7
9. Medium · 4.3 ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.8 - Cross-Site Request Forgery ↗
   2026-07-02 CVE-2026-57759 Cross-Site Request Forgery (CSRF) Affects <= 5.9.9.8 No patch available
10. Critical · 9.8 ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite ↗
    2026-06-29 CVE-2026-12073 Authorization Bypass Through User-Controlled Key Affects <= 5.9.9.5 Patched in 5.9.9.6
11. Medium · 6.4 ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content ↗
    2026-06-22 CVE-2026-4610 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.9.2 Patched in 5.9.9.3
12. Medium · 6.5 ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter ↗
    2026-05-12 CVE-2026-4608 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.9.8.4 Patched in 5.9.8.5
13. Medium · 4.3 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification ↗
    2026-05-12 CVE-2026-4607 Missing Authorization Affects <= 5.9.8.4 Patched in 5.9.8.5
14. High · 7.1 ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining ↗
    2026-05-12 CVE-2026-4609 Missing Authorization Affects <= 5.9.8.4 Patched in 5.9.8.5
15. Medium · 6.4 ProfileGrid – User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2026-03-23 CVE-2026-25417 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.8.1 Patched in 5.9.8.2
16. Medium · 4.3 ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion ↗
    2026-03-06 CVE-2026-2488 Missing Authorization Affects <= 5.9.8.1 Patched in 5.9.8.2
17. Medium · 4.3 ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial ↗
    2026-03-06 CVE-2026-2494 Cross-Site Request Forgery (CSRF) Affects <= 5.9.8.2 Patched in 5.9.8.3
18. Medium · 5.3 ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification ↗
    2026-02-04 CVE-2026-1271 Authorization Bypass Through User-Controlled Key Affects <= 5.9.7.2 Patched in 5.9.7.3
19. Medium · 4.3 ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension ↗
    2026-02-04 CVE-2025-13416 Missing Authorization Affects <= 5.9.7.2 Patched in 5.9.7.3
20. Medium · 6.1 ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.7 - Reflected Cross-Site Scripting ↗
    2025-09-01 CVE-2025-4957 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.5.7 Patched in 5.9.5.8
21. Medium · 6.5 ProfileGrid <= 5.9.5.3 - Authenticated (Subscriber+) SQL Injection ↗
    2025-07-24 CVE-2025-49033 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.9.5.3 Patched in 5.9.5.4
22. Medium · 6.1 ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function ↗
    2025-07-15 CVE-2025-6977 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.5.4 Patched in 5.9.5.5
23. Medium · 6.5 ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) SQL Injection ↗
    2025-07-10 CVE-2025-49876 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.9.5.2 Patched in 5.9.5.3
24. Medium · 4.3 ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) Full Path Disclosure ↗
    2025-06-19 CVE-2025-52719 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 5.9.5.2 Patched in 5.9.5.3
25. Medium · 6.4 ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) Server-Side Request Forgery ↗
    2025-06-12 CVE-2025-49877 Server-Side Request Forgery (SSRF) Affects <= 5.9.5.2 Patched in 5.9.5.3
26. Medium · 4.3 ProfileGrid <= 5.9.5.1 - Missing Authorization ↗
    2025-05-16 CVE-2025-48079 Missing Authorization Affects <= 5.9.5.1 Patched in 5.9.5.2
27. Medium · 6.5 ProfileGrid <= 5.9.5.0 - Authenticated (Subscriber+) SQL Injection ↗
    2025-05-12 CVE-2025-47478 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.9.5.0 Patched in 5.9.5.1
28. Medium · 6.5 ProfileGrid <= 5.9.4.8 - Authenticated (Subscriber+) SQL Injection ↗
    2025-04-17 CVE-2025-39586 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.9.4.8 Patched in 5.9.4.9
29. High · 8.8 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection ↗
    2025-03-21 CVE-2025-0724 Deserialization of Untrusted Data Affects <= 5.9.4.5 Patched in 5.9.4.6
30. Medium · 4.3 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management ↗
    2025-03-21 CVE-2025-1408 Missing Authorization Affects <= 5.9.4.4 Patched in 5.9.4.5
31. Medium · 6.5 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection ↗
    2025-03-21 CVE-2025-0723 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.9.4.7 Patched in 5.9.4.8
32. High · 8.8 ProfileGrid <= 5.9.4.3 - Authenticated (Subscriber+) PHP Object Injection ↗
    2025-02-23 CVE-2025-26999 Deserialization of Untrusted Data Affects <= 5.9.4.3 Patched in 5.9.4.4
33. Medium · 4.3 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure ↗
    2025-02-17 CVE-2024-13740 Authorization Bypass Through User-Controlled Key Affects <= 5.9.4.2 Patched in 5.9.4.3
34. Medium · 5.4 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery ↗
    2025-02-17 CVE-2024-13741 Server-Side Request Forgery (SSRF) Affects <= 5.9.4.2 Patched in 5.9.4.3
35. Medium · 6.5 ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion ↗
    2024-11-19 CVE-2024-10900 Missing Authorization Affects <= 5.9.3.6 Patched in 5.9.3.7
36. Medium · 4.3 ProfileGrid <= 5.9.3 - Cross-Site Request Forgery ↗
    2024-10-14 CVE-2024-49273 Cross-Site Request Forgery (CSRF) Affects <= 5.9.3 Patched in 5.9.3.1
37. Medium · 6.4 ProfileGrid – User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-09-25 CVE-2024-8861 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.9.3.2 Patched in 5.9.3.3
38. Medium · 4.3 ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2024-07-09 CVE-2024-6410 Authorization Bypass Through User-Controlled Key Affects <= 5.8.9 Patched in 5.9.0
39. High · 8.8 ProfileGrid – User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation ↗
    2024-07-09 CVE-2024-6411 Improper Privilege Management Affects <= 5.8.9 Patched in 5.9.0
40. Medium · 5.4 ProfileGrid <= 5.8.7 - Missing Authorization ↗
    2024-07-01 CVE-2024-37453 Missing Authorization Affects <= 5.8.7 Patched in 5.8.8
41. Medium · 4.3 ProfileGrid <= 5.8.6 - Missing Authorization ↗
    2024-06-04 CVE-2024-5453 Missing Authorization Affects <= 5.8.6 Patched in 5.8.7
42. Medium · 6.4 ProfileGrid <= 5.7.1 - Authenticated (Contributor+) SQL Injection ↗
    2024-04-26 CVE-2024-30241 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.7.1 Patched in 5.7.2
43. Medium · 4.3 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object Reference ↗
    2024-04-22 CVE-2024-32808 Authorization Bypass Through User-Controlled Key Affects <= 5.7.9 Patched in 5.8.0
44. Medium · 5.3 ProfileGrid <= 5.8.2 - Bypass Group Members Limit ↗
    2024-04-22 CVE-2024-32774 Improper Authorization Affects <= 5.8.2 Patched in 5.8.3
45. Medium · 4.3 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.7.9 - Insecure Direct Object Reference ↗
    2024-04-22 CVE-2024-32772 Authorization Bypass Through User-Controlled Key Affects <= 5.7.9 Patched in 5.8.0
46. Medium · 4.3 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization ↗
    2024-04-16 CVE-2024-3606 Missing Authorization Affects <= 5.8.3 Patched in 5.8.4
47. Medium · 4.3 ProfileGrid <= 5.7.8 - Cross-Site Request Forgery ↗
    2024-04-08 CVE-2024-31362 Cross-Site Request Forgery (CSRF) Affects <= 5.7.8 Patched in 5.7.9
48. Medium · 4.3 ProfileGrid <= 5.7.6 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2024-04-05 CVE-2024-31291 Authorization Bypass Through User-Controlled Key Affects <= 5.7.6 Patched in 5.7.7
49. Critical · 10.0 ProfileGrid <= 5.7.8 - Unauthenticated SQL Injection ↗
    2024-03-28 CVE-2024-30490 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.7.8 Patched in 5.7.9
50. Critical · 9.9 ProfileGrid <= 5.7.8 - Authenticated (Subscriber+) SQL Injection ↗
    2024-03-28 CVE-2024-30491 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 5.7.8 Patched in 5.7.9
51. Medium · 4.3 ProfileGrid <= 5.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2024-03-28 CVE-2024-30513 Authorization Bypass Through User-Controlled Key Affects <= 5.7.2 Patched in 5.7.3
52. Medium · 4.3 ProfileGrid <= 5.6.6 - Missing Authorization ↗
    2023-12-28 CVE-2023-52117 Missing Authorization Affects <= 5.6.6 Patched in 5.6.7
53. Medium · 4.3 ProfileGrid <= 5.7.1 - Cross-Site Request Forgery ↗
    2023-11-07 CVE-2023-47644 Cross-Site Request Forgery (CSRF) Affects <= 5.7.1 Patched in 5.7.2
54. High · 8.8 ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update ↗
    2023-07-17 CVE-2023-3713 Missing Authorization Affects <= 5.5.1 Patched in 5.5.2
55. Medium · 4.9 ProfileGrid <= 5.5.0 - Hardcoded Encryption Key ↗
    2023-07-17 CVE-2023-3404 Use of Hard-coded Cryptographic Key Affects <= 5.5.0 Patched in 5.5.1
56. High · 7.5 ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation ↗
    2023-07-17 CVE-2023-3714 Missing Authorization Affects <= 5.5.2 Patched in 5.5.3
57. Medium · 5.4 ProfileGrid <= 5.5.1 - Missing Authorization to User Import ↗
    2023-07-17 CVE-2023-3403 Missing Authorization Affects <= 5.5.1 Patched in 5.5.2
58. High · 8.8 ProfileGrid <= 5.3.0 - Missing Authorization to Arbitrary Password Reset ↗
    2023-02-27 CVE-2023-0940 Missing Authorization Affects <= 5.3.0 Patched in 5.3.1
59. Medium · 6.3 ProfileGrid <= 5.1.7 - Authenticated (Subscriber+) CSV Injection ↗
    2022-11-17 CVE-2022-41791 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects <= 5.1.7 Patched in 5.1.8
60. Medium · 5.4 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.0.3 - Missing Authorization to Information Exposure ↗
    2022-10-27 CVE-2022-36352 Missing Authorization Affects <= 5.0.3 Patched in 5.0.4
61. Medium · 6.1 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.1.0 - Reflected Cross-Site Scripting ↗
    2022-10-19 CVE-2022-3578 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.0 Patched in 5.1.1
62. Medium · 6.4 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 4.7.4 - Stored Cross-Site Scripting via Profile ↗
    2022-01-18 CVE-2022-0233 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.7.4 Patched in 4.7.7
63. High · 8.8 ProfileGrid – User Profiles, Memberships, Groups and Communities < 2.8.6 - Remote Code Execution ↗
    2018-05-18 CVE-2019-15873 Improper Control of Generation of Code ('Code Injection') Affects < 2.8.6 Patched in 2.8.6

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 28 languages, 6 at 90% or more

Plus 4 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-07-10 6K+ → 5K+ down after 283 days in tier
2. 2025-09-30 7K+ → 6K+ down after 994 days in tier
3. 2023-01-10 8K+ → 7K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin 200K+ installs · 4.4★ · 3 shared tags A
• U Ultimate Member – reCAPTCHA 20K+ installs · 3.8★ · 3 shared tags C
• WP User Manager – User Profile Builder & Membership 10K+ installs · 4.7★ · 3 shared tags A
• Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress 5K+ installs · 4.8★ · 3 shared tags A
• Ultimate Member – Terms & Conditions 4K+ installs · 4.0★ · 3 shared tags C
• Ultimate Member – Online Users 3K+ installs · 3.9★ · 3 shared tags C

Embed this report card

Drop a live Pulse card for ProfileGrid – User Profiles, Groups and Communities into a readme, a review or a deck. It updates itself.

ProfileGrid – User Profiles, Groups and Communities: 5K+ active installs, 4.6★ (236 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/profilegrid-user-profiles-groups-and-communities