Themegrill - vulnerabilities (CVEs)

40 CVEs in 17 products, 9 in the last 30 days, newest from 2026-10-18.

Products

User Registration - 10 CVEs
Colormag - 3 CVEs
Masteriyo - 3 CVEs
Masteriyo - Lms - 3 CVEs
Themegrill Demo Importer - 3 CVEs
Himalayas - 2 CVEs
Maintenance Page - 2 CVEs
User Registration Stripe - 2 CVEs
Zakra - 2 CVEs
Accelerate - 1 CVEs
Colornews - 1 CVEs
Esteem - 1 CVEs
Estore - 1 CVEs
Magazine Blocks - 1 CVEs
Registration Form For Woocommerce - 1 CVEs
Smartsmtp - 1 CVEs
Spacious - 1 CVEs

Newest CVEs of Themegrill

CVE-2026-108485 - CVSS 7.1 (high), 2026-10-18: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue…
CVE-2026-105882 - CVSS 6.5 (medium), 2026-10-15: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows…
CVE-2026-109692 - CVSS 7.1 (high), 2026-10-15: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security…
CVE-2026-109699 - CVSS 5.4 (medium), 2026-10-13: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security…
CVE-2026-106598 - CVSS 5.3 (medium), 2026-10-13: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User…
CVE-2026-105881 - CVSS 6.5 (medium), 2026-10-13: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows…
CVE-2026-103076 - CVSS 5.4 (medium), 2026-10-13: Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User…
CVE-2026-106597 - CVSS 5.3 (medium), 2026-10-13: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security…
CVE-2026-96334 - CVSS 5.6 (medium), 2026-10-09: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security…
CVE-2026-78290 - CVSS 6.5 (medium), 2026-08-24: Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.
CVE-2026-66606 - CVSS 7.1 (high), 2026-08-20: Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
CVE-2025-9266 - CVSS 4.3 (medium), 2026-08-06: The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in…
CVE-2026-4804 - CVSS 6.4 (medium), 2026-07-03: The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to…
CVE-2026-52701 - CVSS 6.5 (medium), 2026-06-26: Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
CVE-2026-54807 - CVSS 9.8 (critical), 2026-06-17: Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.
CVE-2026-49081 - CVSS 8.2 (high), 2026-06-17: Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.
CVE-2026-40726 - CVSS 8.2 (high), 2026-06-17: Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.
CVE-2026-42743 - CVSS 6.5 (medium), 2026-06-15: Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.
CVE-2026-39524 - CVSS 7.5 (high), 2026-06-15: Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
CVE-2026-25425 - CVSS 7.5 (high), 2026-06-15: Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
CVE-2026-49111 - CVSS 8.8 (high), 2026-06-15: Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through…
CVE-2026-40730 - CVSS 5.3 (medium), 2026-04-15: Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control…
CVE-2025-9331 - CVSS 4.3 (medium), 2025-08-22: The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler'…
CVE-2025-9202 - CVSS 4.3 (medium), 2025-08-20: The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler()…
CVE-2025-8595 - CVSS 4.3 (medium), 2025-08-06: The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler()…
CVE-2024-33939 - CVSS 5.3 (medium), 2025-05-19: Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo -…
CVE-2020-36837 - CVSS 9.9 (critical), 2024-10-16: The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions…
CVE-2024-9218 - CVSS 6.1 (medium), 2024-10-02: The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to…
CVE-2024-39629 - CVSS 5.9 (medium), 2024-08-01: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue…
CVE-2024-37432 - CVSS 6.1 (medium), 2024-07-22: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Esteem allows Stored XSS.This issue…