G5Theme Grid Plus vulnerabilities

Latest G5Theme Grid Plus CVEs

Newest publication first

1. CVE-2025-53352 WordPress Grid Plus plugin <= 3.3 - Cross Site Scripting (XSS) vulnerability

   Published 2025-10-22

   High·CVSS 7.1 EPSS 0.25%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Grid Plus grid-plus allows Reflected XSS.This issue affects Grid Plus: from n/a through <= 3.3.

2. CVE-2023-34014 WordPress Grid Plus plugin <= 1.3.2 - Broken Access Control vulnerability

   Published 2024-12-13

   Medium·CVSS 5.4 EPSS 0.45%

   Missing Authorization vulnerability in G5Theme Grid Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grid Plus: from n/a through 1.3.2.

3. CVE-2023-5251 Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete

   Published 2023-10-30

   Medium·CVSS 5.4 EPSS 0.58%

   The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save_layout_callback' and 'grid_plus_delete_callback' functions in versions up to, and including, 1.3.2. This makes it possib...

4. CVE-2023-5250 Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode

   Published 2023-10-30

   High·CVSS 8.8 EPSS 1.3%

   The Grid Plus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.3 via a shortcode attribute. This allows subscriber-level, and above, attackers to include and execute arbitrary files on the server, allowing the execution of any PHP c...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.