Input validation vulnerability in ProfileGrid – User Profiles, Groups and Communities 5.9.3.2

A plugin called ProfileGrid, used for creating user profiles, groups, and communities on WordPress, has a security issue. This issue, known as Stored Cross-Site Scripting, affects all versions of the plugin up to 5.9.3.2. The problem is caused by a mistake in the way the plugin uses a function called wp_kses_allowed_html. This mistake allows attackers who have Contributor-level access or higher to insert harmful web scripts into pages. These scripts will then run whenever a user visits the affected page.