9.0
Critical
CVE-2026-103693 The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…
Description
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Frontend Dashboard 3.0 | earliest → < 3.0.5 | 3.0.5 |
| ProfileGrid 6.0 | earliest → < 6.0.0.5 | 6.0.0.5 |