High severity8.8NVD Advisory· Published Sep 3, 2019· Updated Jun 17, 2026

CVE-2019-15873

Description

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pm_template_preview&html=<?php substring followed by PHP code.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Metagauss/Profilegrid
cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*
Range: <2.8.6
WordPress/profilegrid-user-profiles-groups-and-communities plugindescription
WordPress/Profilegrid User Profiles Groups And Communitiesllm-fuzzy
Range: <2.8.6
Package: https://wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities

Patches

Vulnerability mechanics

References

wpvulndb.com/vulnerabilities/9086nvdExploitThird Party Advisory
wordpress.org/plugins/profilegrid-user-profiles-groups-and-communities/nvdRelease NotesThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000