ThemeOne vulnerabilities

Products

• The Grid 4

Latest ThemeOne CVEs

Newest publication first

1. CVE-2026-28191 WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability

   Published 2026-08-18

   High·CVSS 8.8

   Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0.

2. CVE-2026-24370 WordPress The Grid plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability

   Published 2026-03-25

   Medium·CVSS 6.5

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0.

3. CVE-2026-24369 WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability

   Published 2026-03-25

   High·CVSS 7.1

   Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.

4. CVE-2026-24368 WordPress The Grid plugin <= 2.8.0 - Broken Access Control vulnerability

   Published 2026-01-22

   Medium·CVSS 5.3

   Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.