ThemeGoods

Records57All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high28CVSS 7.0–8.9

Exploited now

ThemeGoods records in CISA KEV

No ThemeGoods vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Grand Restaurant 6 records MEDIUM Grand Conference 3 records MEDIUM Photography 3 records MEDIUM Altair 1 record MEDIUM Grand Tour 1 record MEDIUM

Records

57 records

TI-2026-41593 CVE-2026-57770 · GHSA-5c67-234g-m9jx

WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-07-13 No fix listed CWE-502

TI-2025-26227 CVE-2025-39485 · GHSA-2g6j-8hm3-67hp

WordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2025-05-23 No fix listed CWE-502

TI-2025-23947 CVE-2025-32926 · GHSA-7c8r-v4x3-jvvm

WordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerability

MEDIUM 50

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00576 Published 2025-05-19 No fix listed CWE-22

TI-2026-18964 CVE-2026-23542 · GHSA-5h6j-gr7x-5qpg

WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00455 Published 2026-02-19 No fix listed CWE-502

TI-2025-42813 CVE-2025-69370 · GHSA-p2vq-xhgq-wqqr

WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00446 Published 2026-02-20 No fix listed CWE-502

TI-2025-42744 CVE-2025-69301 · GHSA-4r8w-crc8-mqph

WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00446 Published 2026-02-20 No fix listed CWE-502

TI-2025-26096 CVE-2025-39354 · GHSA-p5p2-m2mh-3r9v

WordPress Grand Conference theme <= 5.3 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-05-19 No fix listed CWE-502

TI-2025-26090 CVE-2025-39348 · GHSA-j6mm-98gm-g9jj

WordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-05-19 No fix listed CWE-502

TI-2025-23949 CVE-2025-32928 · GHSA-848q-rw57-4rf8

WordPress Altair theme <= 5.2.2 - PHP Object Injection vulnerability

MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00485 Published 2025-05-19 No fix listed CWE-502

TI-2025-14306 CVE-2025-15689 · GHSA-wq94-w84x-hxwv

WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability

MEDIUM 49

Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-08-20 No fix listed CWE-266

TI-2024-11973 CVE-2024-12922 · GHSA-7gcv-7v86-g6jc

Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current

MEDIUM 49

The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check within functions.php in all versions up to, and including, 5.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00518 Published 2025-03-19 No fix listed CWE-862

TI-2025-14305 CVE-2025-15688 · GHSA-ggjj-qx27-2jh5

WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-08-20 No fix listed CWE-89

TI-2026-17998 CVE-2026-22417 · GHSA-vff3-f8rm-pq96

WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

MEDIUM 44

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00606 Published 2026-03-05 No fix listed CWE-502

TI-2025-26094 CVE-2025-39352 · GHSA-75pg-hm2h-v575

WordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability

MEDIUM 42

Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00321 Published 2025-05-19 No fix listed CWE-862

TI-2025-30076 CVE-2025-47579 · GHSA-qf54-mr3w-jmww

WordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability

MEDIUM 41

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00325 Published 2025-09-09 No fix listed CWE-502

TI-2025-30081 CVE-2025-47584 · GHSA-hfwv-wh7f-hj5m

WordPress Photography theme <= 7.5.2 - PHP Object Injection vulnerability

LOW 39

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00395 Published 2025-06-06 No fix listed CWE-502

TI-2026-70350 CVE-2026-42706 · GHSA-2fpp-g3hj-qhqr

Broken access control in ThemeGoods DK WordPress theme

LOW 38

Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00246 Published 2026-10-10 No fix listed CWE-862

TI-2026-70349 CVE-2026-42705 · GHSA-5g75-fv5c-63hr

Broken access control in ThemeGoods Grand News WordPress theme

LOW 38

Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00246 Published 2026-10-10 No fix listed CWE-862

TI-2025-42031 CVE-2025-68510 · GHSA-qj62-79j9-vf3g

WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability

LOW 38

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography:…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00484 Published 2026-01-22 No fix listed CWE-98

TI-2025-37482 CVE-2025-60116 · GHSA-q4gj-97g2-cwmr

WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Confe…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00305 Published 2025-09-26 No fix listed CWE-862

TI-2025-33845 CVE-2025-53999 · GHSA-f42p-gfh3-368w

WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

LOW 35

Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2026-08-20 No fix listed CWE-862

TI-2026-21506 CVE-2026-27043 · GHSA-rrhg-36hf-rgw9

WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability

LOW 34

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00373 Published 2026-03-19 Fixed in 7.7.6 CWE-434

TI-2026-41592 CVE-2026-57769 · GHSA-w67x-xfqq-cj4r

WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-23 No fix listed CWE-79

TI-2026-21783 CVE-2026-27367 · GHSA-qpw4-8jph-882q

WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00214 Published 2026-03-05 No fix listed CWE-79

TI-2026-21774 CVE-2026-27358 · GHSA-3p66-r746-8vwf

WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00214 Published 2026-03-05 No fix listed CWE-79

Open these records in search →