CVE-2026-4610 is a stored cross-site scripting vulnerability in the ProfileGrid – User Profiles, Groups and Communities plugin for WordPress. The issue arises from improper neutralization of input in the 'pm_author_message' parameter handled by the pm_send_message_to_author function. Authenticated attackers with at least Subscriber privileges can inject arbitrary web scripts that execute in the context of other users viewing the injected content. Although a partial fix was applied in version 5.9.8.5, versions up to and including 5.9.9.2 remain vulnerable due to incomplete sanitization and escaping.

Successful exploitation allows authenticated users with Subscriber-level access or higher to inject and execute arbitrary scripts in other users' browsers. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A partial patch was introduced in version 5.9.8.5, but versions up to 5.9.9.2 remain vulnerable. Users should monitor the vendor's official channels for updates and apply any forthcoming official fixes. Until a full patch is available, consider restricting Subscriber-level permissions or disabling the vulnerable functionality if feasible.