Skip to content
OpenAdvisories

Vendor

Metagauss

118 known vulnerabilities.

Products

ProfileGrid – User Profiles, Groups and Communities 25 ProfileGrid 25 RegistrationMagic 18 EventPrime – Events Calendar, Bookings and Tickets 17 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login 15 EventPrime 12 Download Plugin 3 Event Kikfyre 1 Download Theme 1 Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.1
    CVE-2026-82221 Public exploit

    WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

    Metagauss RegistrationMagic
  • Medium 5.3
    CVE-2026-1657 Public exploit

    EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint

    The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabled) without implemen…

    Metagauss EventPrime – Events Calendar, Bookings and Tickets Web / CMS
  • Critical 9.8
    CVE-2025-15403 Public exploit Scanner template

    RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order

    The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' function is accessible via the 'rm_user_exists' AJAX action and allows arbitrary updates to the 'admi…

    Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Web / CMS
  • High 7.2
    CVE-2025-6586 Public exploit

    Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload

    The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_locInstall function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with …

    Metagauss Download Plugin Web / CMS
  • Critical 9.8
    CVE-2024-10508 Public exploit

    RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery

    The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.2.6. This is due to the plugin not properly validating th…

    Metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Web / CMS