CVE Intelligence

Vulnerabilidades de ThemeGrill

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de ThemeGrill: 19 registro(s), com severidade, exploração e correções.

User Registration 10Masteriyo - LMS 3User Registration Stripe 2Registration Form for WooCommerce 1ThemeGrill Demo Importer 1Magazine Blocks 1Zakra 1

Somente exploradas (KEV) →

CVE-2026-109692 Alta · 7.1 CWE-862 15/10/2026
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-105882 Média · 6.5 CWE-79 15/10/2026
WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-109699 Média · 5.4 CWE-862 13/10/2026
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-106598 Média · 5.3 CWE-862 13/10/2026
WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-106597 Média · 5.3 CWE-862 13/10/2026
WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-105881 Média · 6.5 CWE-79 13/10/2026
WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-103076 Média · 5.4 CWE-352 13/10/2026
WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8.
CVE-2026-96334 Média · 5.6 CWE-862 09/10/2026
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.
CVE-2026-78290 Média · 6.5 CWE-79 24/08/2026
WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
CVE-2026-4804 Média · 6.4 CWE-79 03/07/2026
Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API
The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.
CVE-2026-52701 Média · 6.5 CWE-862 26/06/2026
WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
CVE-2026-54807 Crítica · 9.8 CWE-266 17/06/2026
WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
CVE-2026-49081 Alta · 8.2 CWE-862 17/06/2026
WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
CVE-2026-40726 Alta · 8.2 CWE-862 17/06/2026
WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.
CVE-2026-42743 Média · 6.5 CWE-347 15/06/2026
WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
CVE-2026-39524 Alta · 7.5 CWE-862 15/06/2026
WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
CVE-2026-25425 Alta · 7.5 CWE-862 15/06/2026
WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
CVE-2026-49111 Alta · 8.8 CWE-266 15/06/2026
WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2.2.0.
CVE-2026-40730 Média · 5.3 CWE-862 15/04/2026
WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.