Skip to content
PluginCanary

ProfileGrid

ProfileGrid - User Profiles, Groups and Communities
by Metagauss · 5,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 26 Oct 2026, 62 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for ProfileGrid
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is ProfileGrid still maintained?
Yes. Last release 26 Oct 2026, 62 releases in the last 24 months. 26 Oct 2026 · wordpress.org
Who owns ProfileGrid, and has it changed hands?
No change recorded. Main committer metagauss since Jun 2021. 3 Nov 2026 · SVN log
Was ProfileGrid removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is ProfileGrid safe?
65 known vulnerabilities, all fixed (latest in 6.0.0.3). Not on the exploited list. 4 Oct 2026 · Wordfence Intelligence
Is the latest ProfileGrid update safe to install?
No ownership change before 6.0.0.6. No one-star spike after it. 26 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
profilegrid26 Dec 2016 to 10 Oct 2020, 219 commits
profilegrid028 Oct 2020 to 9 Jan 2024, 41 commits
metagauss7 Jun 2021 to 26 Oct 2026, 428 commits

3 committers recorded. No ownership change since 2016.

Maintenance

Last release
9 days ago
Releases, 24 months
62
Tested up to
7.0 vs 7.1
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for ProfileGrid
Q1 20249
Q2 20248
Q3 20248
Q4 20246
Q1 20258
Q2 20256
Q3 20257
Q4 20257
Q1 202611
Q2 20269
Q3 20266
Q4 20263

Last release 26 Oct 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.6.

Rating distribution
5 star200
4 star13
3 star5
2 star4
1 star14

Security record

37 vulnerabilities in 24 months (65 on record), all patched (latest fixed in 6.0.0.3).

Show 65 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
4 Oct 2026ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Authenticated (Subscriber+) SQL Injection6.5<= 6.0.0.26.0.0.3Patched before disclosure
1 Oct 2026ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Unauthenticated Insecure Direct Object Reference5.3<= 6.0.0.26.0.0.3Patched before disclosure
2 Aug 2026ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3< 5.9.9.85.9.9.8Patched before disclosure
30 Jul 2026ProfileGrid <= 5.0.0.0 - Missing Authorization5.3<= 5.0.0.06.0.0.0Patched before disclosure
24 Jul 2026ProfileGrid <= 5.0.0.0 - Missing Authorization4.3<= 5.0.0.06.0.0.0Patched before disclosure
10 Jul 2026ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Unauthenticated Group Registration Bypass6.5< 5.9.9.85.9.9.8Patched before disclosure
8 Jul 2026ProfileGrid – User Profiles, Groups and Communities <= 5.9.9.6 - Unauthenticated Privilege Escalation via Password Reset9.8<= 5.9.9.65.9.9.7Patched before disclosure
3 Jul 2026ProfileGrid <= 5.9.9.6 - Missing Authorization4.3<= 5.9.9.65.9.9.7Patched before disclosure
3 Jul 2026ProfileGrid <= 5.9.9.6 - Missing Authorization4.3<= 5.9.9.65.9.9.7Patched before disclosure
3 Jul 2026ProfileGrid <= 5.9.9.6 - Unauthenticated Payment Bypass5.3<= 5.9.9.65.9.9.7Patched before disclosure
2 Jul 2026ProfileGrid – User Profiles, Groups and Communities <= 6.0.0.2 - Cross-Site Request Forgery4.3<= 6.0.0.26.0.0.390
29 Jun 2026ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite9.8<= 5.9.9.55.9.9.6Patched before disclosure
22 Jun 2026ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content6.4<= 5.9.9.25.9.9.3Patched before disclosure
12 May 2026ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification4.3<= 5.9.8.45.9.8.5Patched before disclosure
12 May 2026ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining7.1<= 5.9.8.45.9.8.5Patched before disclosure
12 May 2026ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter6.5<= 5.9.8.45.9.8.5Patched before disclosure
23 Mar 2026ProfileGrid – User Profiles, Groups and Communities <= 5.9.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4<= 5.9.8.15.9.8.2Patched before disclosure
6 Mar 2026ProfileGrid <= 5.9.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion4.3<= 5.9.8.15.9.8.2Patched before disclosure
6 Mar 2026ProfileGrid <= 5.9.8.2 - Cross-Site Request Forgery to Group Membership Request Approval/Denial4.3<= 5.9.8.25.9.8.3Patched before disclosure
4 Feb 2026ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification5.3<= 5.9.7.25.9.7.3Patched before disclosure
4 Feb 2026ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension4.3<= 5.9.7.25.9.7.3Patched before disclosure
1 Sep 2025ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.7 - Reflected Cross-Site Scripting6.1<= 5.9.5.75.9.5.8Patched before disclosure
24 Jul 2025ProfileGrid <= 5.9.5.3 - Authenticated (Subscriber+) SQL Injection6.5<= 5.9.5.35.9.5.4Patched before disclosure
15 Jul 2025ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function6.1<= 5.9.5.45.9.5.5Patched before disclosure
10 Jul 2025ProfileGrid <= 5.9.5.2 - Authenticated (Subscriber+) SQL Injection6.5<= 5.9.5.25.9.5.3Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 2 support threads resolved in the last 2 months.

Momentum

5,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for ProfileGrid
4 May 2026545
11 May 2026849
18 May 20263,824
25 May 20263,571
1 Jun 2026742
8 Jun 20263,245
15 Jun 20263,374
22 Jun 20261,170
29 Jun 20263,843
6 Jul 20264,028
13 Jul 20263,925
20 Jul 20266,022
27 Jul 20261,018
3 Aug 2026912
10 Aug 2026549
17 Aug 2026450
24 Aug 2026512
31 Aug 20262,995
7 Sep 20261,010
14 Sep 20261,174
21 Sep 2026709
28 Sep 20263,652
5 Oct 20263,743
12 Oct 20261,169
19 Oct 20263,514
26 Oct 20264,461
2 Nov 2026199

Weekly downloads over the last 4 weeks are 3% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

LoginWP (Formerly Peter's LoginScore 92 · 80,000+Simple User AvatarScore 92 · 20,000+Gravatar EnhancedScore 91 · 100,000+WP User AvatarsScore 91 · 20,000+One User AvatarScore 89 · 100,000+

Facts

Version6.0.0.6
AuthorMetagauss
Added30 Nov 2016
Last updated26 Oct 2026
Active installs5,000+
Requires WordPress3.5
Tested up to7.0.8
Requires PHP7.4
CategoryCommunity & Social > Membership Sites & Subscriptions
Tagsprofile, community, membership, user profile, profile widget

Other plugins by this author: Download Plugin, EventPrime - Events Calendar, Bookings, Tickets & AI, RegistrationMagic - Custom Registration Forms, User Registration, Payment, and User Login, Download Theme, Themeflection Numbers - Number Counter and Animated Numbers, Memberships and User Profiles for WooCommerce - ProfileGrid WooCommerce Integration, Blog Post Sidebar

Questions

Is ProfileGrid still maintained?

Yes. Last release 26 Oct 2026, 62 releases in the last 24 months.

Who owns ProfileGrid, and has it changed hands?

No change recorded. Main committer metagauss since Jun 2021.

Was ProfileGrid removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is ProfileGrid safe?

65 known vulnerabilities, all fixed (latest in 6.0.0.3). Not on the exploited list.

Is the latest ProfileGrid update safe to install?

No ownership change before 6.0.0.6. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue