CVE-2026-4610 is a stored cross-site scripting vulnerability in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'pm_author_message' parameter in the pm_send_message_to_author function. Authenticated attackers with Subscriber-level privileges or higher can inject arbitrary web scripts that execute in the context of other users viewing the injected content. The vulnerability affects all versions prior to 5.9.8.5 and continues through 5.9.9.2 despite a partial patch in 5.9.8.5. No official fix or patch is confirmed as of the published date.

An attacker with at least Subscriber-level access can store malicious scripts that execute in other users' browsers when they access the injected pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the victim's privileges. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since a partial patch was applied in version 5.9.8.5 but versions up to 5.9.9.2 remain vulnerable, users should monitor for an official fix from the vendor. Until then, restrict Subscriber-level access where possible and consider disabling or replacing the plugin if feasible.