Vulnerabilities

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-10-09 Fixed in 7.0.11 CWE-79

TI-2026-47323 CVE-2026-66652 · GHSA-hr78-p3w8-cqhw

WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

LOW 23

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00138 Published 2026-09-02 No fix listed CWE-352

TI-2025-33845 CVE-2025-53999 · GHSA-f42p-gfh3-368w

WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

LOW 35

Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00332 Published 2026-08-20 No fix listed CWE-862

TI-2025-14306 CVE-2025-15689 · GHSA-wq94-w84x-hxwv

WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability

MEDIUM 49

Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00483 Published 2026-08-20 No fix listed CWE-266

TI-2025-14305 CVE-2025-15688 · GHSA-ggjj-qx27-2jh5

WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-08-20 No fix listed CWE-89

TI-2026-46657 CVE-2026-65487 · GHSA-q7c8-h34g-m94m

WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

LOW 30

Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00294 Published 2026-07-23 No fix listed CWE-862

TI-2026-41592 CVE-2026-57769 · GHSA-w67x-xfqq-cj4r

WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-23 No fix listed CWE-79

TI-2026-41593 CVE-2026-57770 · GHSA-5c67-234g-m9jx

WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

MEDIUM 50

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00564 Published 2026-07-13 No fix listed CWE-502

TI-2025-42606 CVE-2025-69152 · GHSA-jjcv-hgrx-x8hh

WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00251 Published 2026-07-02 No fix listed CWE-79

TI-2025-42045 CVE-2025-68524 · GHSA-8xjg-38xf-pjc5

WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-06-17 Fixed in 3.0.5 CWE-79

TI-2025-42605 CVE-2025-69151 · GHSA-9gmr-4p23-54xx

WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability

LOW 30

Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0018 Published 2026-06-16 No fix listed CWE-79

TI-2026-28606 CVE-2026-39635 · GHSA-h7cf-327q-35rq

WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability

LOW 23

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00102 Published 2026-04-08 No fix listed CWE-352

TI-2026-28605 CVE-2026-39634 · GHSA-p6f6-rx68-r56m

WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability

LOW 23

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00108 Published 2026-04-08 No fix listed CWE-352

TI-2026-28604 CVE-2026-39633 · GHSA-qhjc-chvp-hcjf

WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability

LOW 28

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00099 Published 2026-04-08 No fix listed CWE-352

TI-2026-28603 CVE-2026-39632 · GHSA-c8hx-4wwq-pq7f

WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability

LOW 28

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00128 Published 2026-04-08 No fix listed CWE-352

TI-2026-28574 CVE-2026-39603 · GHSA-3p7h-vrh2-gc3q

WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability

LOW 23

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00108 Published 2026-04-08 No fix listed CWE-352

TI-2026-21506 CVE-2026-27043 · GHSA-rrhg-36hf-rgw9

WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability

LOW 34

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00373 Published 2026-03-19 Fixed in 7.7.6 CWE-434

TI-2026-21783 CVE-2026-27367 · GHSA-qpw4-8jph-882q

WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00214 Published 2026-03-05 No fix listed CWE-79

TI-2026-21774 CVE-2026-27358 · GHSA-3p66-r746-8vwf

WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00214 Published 2026-03-05 No fix listed CWE-79

TI-2026-21770 CVE-2026-27353 · GHSA-gx4f-8j8f-j4gq

WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00214 Published 2026-03-05 No fix listed CWE-79

TI-2026-21769 CVE-2026-27352 · GHSA-2c4c-5wf5-f8m7

WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00228 Published 2026-03-05 No fix listed CWE-79

TI-2026-21766 CVE-2026-27348 · GHSA-79rc-g99x-p5qw

WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00228 Published 2026-03-05 No fix listed CWE-79

TI-2026-17998 CVE-2026-22417 · GHSA-vff3-f8rm-pq96

WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

MEDIUM 44

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00606 Published 2026-03-05 No fix listed CWE-502