Frontend Dashboard and ProfileGrid: PHP object injection (CVE-2026-103693)
CVE-2026-103693 (CVSS 9) affects the Frontend Dashboard and ProfileGrid WordPress plugins. An unauthenticated user can store a serialized PHP object in user metadata, which is deserialized when a public profile is viewed.
Checked in Shield: no
Who is affected
WordPress sites running Frontend Dashboard before version 3.0.5 or ProfileGrid before version 6.0.0.5.
How to check
In the WordPress admin area, open the Plugins page and check the installed versions of Frontend Dashboard and ProfileGrid.
How to fix
Patches are available: Frontend Dashboard 3.0.5 and ProfileGrid 6.0.0.5. Update the plugins to these versions or newer.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The flaw can lead to arbitrary file write and potentially remote code execution; whether it is exploited is not disclosed yet. Source: NVD.
