CVE Intelligence

ThemeGoods vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ThemeGoods products: 37 record(s), with severity, exploitation and fixes.

Photography 4Grand Restaurant 3PhotoMe 3Grand Conference 3Grand Car Rental 2Grand News 2Grand Blog 2Grand Conference Theme Custom Post Type 2Grand Magazine 2Artale | Wedding Photography WordPress 1DK 1Grand Tour 1Avante 1Grand Portfolio 1Grand Photography 1Grand Spa 1Craft 1DotLife 1Hoteller 1Grand Restaurant Theme Elements for Elementor 1Musico 1Architecturer 1Starto 1Grand Wedding 1Capella 1

Exploited only (KEV) →

CVE-2026-42706 High · 7.5 CWE-862 Oct 10, 2026
WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
CVE-2026-42705 High · 7.5 CWE-862 Oct 10, 2026
WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
CVE-2026-94161 High · 7.1 CWE-79 Oct 9, 2026
WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.
CVE-2025-69152 High · 7.1 CWE-79 Jul 2, 2026
WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.
CVE-2025-68524 High · 7.1 CWE-79 Jun 17, 2026
WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.
CVE-2025-69151 High · 7.1 CWE-79 Jun 17, 2026
WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.
CVE-2026-39635 Medium · 5.4 CWE-352 Apr 8, 2026
WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.
CVE-2026-39634 Medium · 5.4 CWE-352 Apr 8, 2026
WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.
CVE-2026-39633 Medium · 6.5 CWE-352 Apr 8, 2026
WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.
CVE-2026-39632 Medium · 6.5 CWE-352 Apr 8, 2026
WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.
CVE-2026-39603 Medium · 5.4 CWE-352 Apr 8, 2026
WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.
CVE-2026-27043 High · 7.2 CWE-434 Mar 19, 2026
WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.
CVE-2026-27367 High · 7.1 CWE-79 Mar 5, 2026
WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.
CVE-2026-27358 High · 7.1 CWE-79 Mar 5, 2026
WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.
CVE-2026-27353 High · 7.1 CWE-79 Mar 5, 2026
WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.
CVE-2026-27352 High · 7.1 CWE-79 Mar 5, 2026
WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.
CVE-2026-27348 High · 7.1 CWE-79 Mar 5, 2026
WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.
CVE-2026-22417 Critical · 9.8 CWE-502 Mar 5, 2026
WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.
CVE-2026-24949 High · 7.1 CWE-79 Feb 20, 2026
WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.
CVE-2026-24943 High · 7.1 CWE-79 Feb 20, 2026
WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflected XSS.This issue affects Grand Conference: from n/a through <= 5.3.4.
CVE-2025-69370 Critical · 9.8 CWE-502 Feb 20, 2026
WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.
CVE-2025-69301 Critical · 9.8 CWE-502 Feb 20, 2026
WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.
CVE-2026-23542 Critical · 9.8 CWE-502 Feb 19, 2026
WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.
CVE-2026-24961 Medium · 5.4 CWE-918 Feb 3, 2026
WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Server Side Request Forgery.This issue affects Grand Blog: from n/a through < 3.1.5.
CVE-2026-24381 Medium · 5.4 CWE-918 Jan 22, 2026
WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability
Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through < 5.7.2.