CVE Intelligence

ThemeGrill vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ThemeGrill products: 18 record(s), with severity, exploitation and fixes.

User Registration 10Masteriyo - LMS 3User Registration Stripe 2Registration Form for WooCommerce 1ThemeGrill Demo Importer 1Magazine Blocks 1

Exploited only (KEV) →

CVE-2026-109692 High · 7.1 CWE-862 Oct 15, 2026
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-105882 Medium · 6.5 CWE-79 Oct 15, 2026
WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-109699 Medium · 5.4 CWE-862 Oct 13, 2026
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-106598 Medium · 5.3 CWE-862 Oct 13, 2026
WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-106597 Medium · 5.3 CWE-862 Oct 13, 2026
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-105881 Medium · 6.5 CWE-79 Oct 13, 2026
WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-103076 Medium · 5.4 CWE-352 Oct 13, 2026
WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-96334 Medium · 5.6 CWE-862 Oct 9, 2026
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.
CVE-2026-78290 Medium · 6.5 CWE-79 Aug 24, 2026
WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
CVE-2026-52701 Medium · 6.5 CWE-862 Jun 26, 2026
WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
CVE-2026-54807 Critical · 9.8 CWE-266 Jun 17, 2026
WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
CVE-2026-49081 High · 8.2 CWE-862 Jun 17, 2026
WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
CVE-2026-40726 High · 8.2 CWE-862 Jun 17, 2026
WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.
CVE-2026-42743 Medium · 6.5 CWE-347 Jun 15, 2026
WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
CVE-2026-39524 High · 7.5 CWE-862 Jun 15, 2026
WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
CVE-2026-25425 High · 7.5 CWE-862 Jun 15, 2026
WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
CVE-2026-49111 High · 8.8 CWE-266 Jun 15, 2026
WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.
CVE-2026-40730 Medium · 5.3 CWE-862 Apr 15, 2026
WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.