ThemeGrill vulnerabilities

Products

• User Registration 15
• Masteriyo - LMS 5
• ThemeGrill Demo Importer 4
• ColorMag 3
• masteriyo 3
• Himalayas 2
• Magazine Blocks 2
• Maintenance Page 2
• Registration Form for WooCommerce 2
• User Registration Stripe 2
• Zakra 2
• Accelerate 1
• ColorNews 1
• Esteem 1
• eStore 1
• SmartSMTP 1
• Spacious 1

Latest ThemeGrill CVEs

Newest publication first · page 1 of 2

1. CVE-2026-119522 WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.27%

   Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.

2. CVE-2026-124258 WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.24%

   Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.

3. CVE-2026-119075 Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout

   Published 2026-11-07

   Critical·CVSS 9.8 EPSS 0.53%

   The Registration Form for WooCommerce plugin for WordPress is vulnerable to privilege escalation due to a missing allow-list check in the FormHandler::validate_checkout_fields() function in versions up to, and including, 1.1.4 The My Account registration path (validate_fields())...

4. CVE-2026-120840 WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 4.3 EPSS 0.24%

   Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.

5. CVE-2026-25450 WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

   Published 2026-10-29

   Medium·CVSS 5.3 EPSS 0.23%

   Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.

6. CVE-2026-25467 WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

   Published 2026-10-29

   Medium·CVSS 5.3 EPSS 0.27%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.

7. CVE-2026-108485 WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-18

   High·CVSS 7.1 EPSS 0.18%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects eStore: from n/a through 1.6.13.

8. CVE-2026-105882 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-15

   Medium·CVSS 6.5 EPSS 0.13%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

9. CVE-2026-109692 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

   Published 2026-10-15

   High·CVSS 7.1 EPSS 0.16%

   Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

10. CVE-2026-109699 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

    Published 2026-10-13

    Medium·CVSS 5.4 EPSS 0.17%

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

11. CVE-2026-106598 WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability

    Published 2026-10-13

    Medium·CVSS 5.3 EPSS 0.19%

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.

12. CVE-2026-105881 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-13

    Medium·CVSS 6.5 EPSS 0.14%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

13. CVE-2026-103076 WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability

    Published 2026-10-13

    Medium·CVSS 5.4 EPSS 0.10%

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8.

14. CVE-2026-106597 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

    Published 2026-10-13

    Medium·CVSS 5.3 EPSS 0.19%

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

15. CVE-2026-96334 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

    Published 2026-10-09

    Medium·CVSS 5.6 EPSS 0.15%

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.

16. CVE-2026-62107 WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

    Published 2026-09-11

    High·CVSS 8.8 EPSS 0.52%

    Deserialization of Untrusted Data vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Object Injection.This issue affects Masteriyo - LMS: from n/a through 3.4.0.

17. CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

    Published 2026-08-24

    Medium·CVSS 6.5 EPSS 0.22%

    Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

18. CVE-2026-66606 WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Published 2026-08-20

    High·CVSS 7.1 EPSS 0.25%

    Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.

19. CVE-2026-73996 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

    Published 2026-08-18

    Critical·CVSS 9.8 EPSS 0.52%

    Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2.

20. CVE-2025-9266 Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

    Published 2026-08-06

    Medium·CVSS 4.3 EPSS 0.26%

    The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access...

21. CVE-2026-4804 Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API

    Published 2026-07-03

    Medium·CVSS 6.4 EPSS 0.28%

    The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active...

22. CVE-2026-52701 WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability

    Published 2026-06-26

    Medium·CVSS 6.5 EPSS 0.27%

    Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

23. CVE-2026-54807 WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability

    Published 2026-06-17

    Critical·CVSS 9.8 EPSS 0.34%

    Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

24. CVE-2026-49081 WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability

    Published 2026-06-17

    High·CVSS 8.2 EPSS 0.29%

    Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

25. CVE-2026-40726 WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability

    Published 2026-06-17

    High·CVSS 8.2 EPSS 0.24%

    Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.