ThemeGoods vulnerabilities

Products

• Photography 9
• Grand Restaurant 8
• Grand Conference 4
• Altair 3
• Capella 3
• Grand Photography 3
• Grand Tour 3
• PhotoMe 3
• Grand Blog 2
• Grand Car Rental 2
• Grand Conference Theme Custom Post Type 2
• Grand Magazine 2
• Grand News 2
• Architecturer 1
• Artale | Wedding Photography WordPress 1
• Avante 1
• Craft 1
• DK 1
• DotLife 1
• Grand Portfolio 1
• Grand Restaurant Theme Elements for Elementor 1
• Grand Spa 1
• Grand Wedding 1
• Hoteller 1
• Musico 1
• Starto 1

Latest ThemeGoods CVEs

Newest publication first · page 1 of 3

1. CVE-2026-42706 WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

   Published 2026-10-10

   High·CVSS 7.5 EPSS 0.25%

   Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

2. CVE-2026-42705 WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

   Published 2026-10-10

   High·CVSS 7.5 EPSS 0.25%

   Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

3. CVE-2026-94161 WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-10-09

   High·CVSS 7.1 EPSS 0.18%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

4. CVE-2026-66652 WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-09-02

   Medium·CVSS 5.4 EPSS 0.14%

   Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

5. CVE-2025-53999 WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

   Published 2026-08-20

   Medium·CVSS 6.5 EPSS 0.33%

   Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

6. CVE-2025-15689 WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability

   Published 2026-08-20

   Critical·CVSS 9.8 EPSS 0.48%

   Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

7. CVE-2025-15688 WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

   Published 2026-08-20

   Critical·CVSS 9.3 EPSS 0.40%

   Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

8. CVE-2026-65487 WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

   Published 2026-07-23

   Medium·CVSS 5.3 EPSS 0.29%

   Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

9. CVE-2026-57769 WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

   Published 2026-07-23

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

10. CVE-2026-57770 WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

    Published 2026-07-13

    Critical·CVSS 9.8 EPSS 0.56%

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

11. CVE-2025-69152 WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Published 2026-07-02

    High·CVSS 7.1 EPSS 0.25%

    Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

12. CVE-2025-68524 WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2026-06-17

    High·CVSS 7.1 EPSS 0.23%

    Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

13. CVE-2025-69151 WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability

    Published 2026-06-16

    High·CVSS 7.1 EPSS 0.18%

    Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

14. CVE-2026-39635 WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-04-08

    Medium·CVSS 5.4 EPSS 0.10%

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.

15. CVE-2026-39634 WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-04-08

    Medium·CVSS 5.4 EPSS 0.11%

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.

16. CVE-2026-39633 WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-04-08

    Medium·CVSS 6.5 EPSS 0.10%

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.

17. CVE-2026-39632 WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-04-08

    Medium·CVSS 6.5 EPSS 0.13%

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.

18. CVE-2026-39603 WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-04-08

    Medium·CVSS 5.4 EPSS 0.11%

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.

19. CVE-2026-27043 WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability

    Published 2026-03-19

    High·CVSS 7.2 EPSS 0.37%

    Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.

20. CVE-2026-27367 WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-03-05

    High·CVSS 7.1 EPSS 0.21%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.

21. CVE-2026-27358 WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-03-05

    High·CVSS 7.1 EPSS 0.21%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.

22. CVE-2026-27353 WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Published 2026-03-05

    High·CVSS 7.1 EPSS 0.21%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.

23. CVE-2026-27352 WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-03-05

    High·CVSS 7.1 EPSS 0.23%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.

24. CVE-2026-27348 WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability

    Published 2026-03-05

    High·CVSS 7.1 EPSS 0.23%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.

25. CVE-2026-22417 WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

    Published 2026-03-05

    Critical·CVSS 9.8 EPSS 0.61%

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.