Skip to content
OpenAdvisories

Vendor

ThemeGoods

57 known vulnerabilities.

ThemeGoods at a glance

Last 12 months
42
Critical · all time
14
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 1 vulnerability Dec 2025 January 2026: 10 vulnerabilities February 2026: 6 vulnerabilities, 3 critical March 2026: 7 vulnerabilities, 1 critical Mar April 2026: 5 vulnerabilities May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 4 vulnerabilities, 1 critical August 2026: 3 vulnerabilities, 2 critical September 2026: 1 vulnerability Sep October 2026: 3 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202630
Sep 202610
Aug 202632
Jul 202641
Jun 202620
May 202600
Apr 202650
Mar 202671
Feb 202663
Jan 2026100
Dec 202510
Nov 202510
Oct 202500
Sep 202521
Aug 202500
Jul 202500
Jun 202510
May 202585
Apr 202510
Mar 202511
Feb 202510
Jan 202500
Dec 202400

Products

Photography 9 Grand Restaurant 8 Grand Photography 3 Altair 3 Grand Tour 3 Capella 3 PhotoMe 3 Grand Blog 2 Grand Conference 2 Grand Car Rental 2 Grand Magazine 2 Grand Conference Theme Custom Post Type 2 Grand News 2 Hoteller 1 Craft 1 Grand Wedding 1 Grand Restaurant Theme Elements for Elementor 1 Grand Portfolio 1 DK 1 Avante 1 Starto 1 Architecturer 1 Grand Spa 1 Musico 1 Artale | Wedding Photography WordPress 1 DotLife 1
All Critical High Medium Low Exploited only Public exploit

57 results · Feed

  • High 7.5
    CVE-2026-42706

    WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

    ThemeGoods DK
  • High 7.5
    CVE-2026-42705

    WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

    ThemeGoods Grand News
  • High 7.1
    CVE-2026-94161

    WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

    ThemeGoods Grand Restaurant
  • Medium 5.4
    CVE-2026-66652

    WordPress Grand Tour theme <= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

    ThemeGoods Grand Tour
  • Medium 6.5
    CVE-2025-53999

    WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.

    ThemeGoods Altair
  • Critical 9.8
    CVE-2025-15689

    WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

    ThemeGoods Capella
  • Critical 9.3
    CVE-2025-15688

    WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

    ThemeGoods Capella
  • Medium 5.3
    CVE-2026-65487

    WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

    ThemeGoods Photography
  • High 7.1
    CVE-2026-57769

    WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

    ThemeGoods Grand Photography
  • Critical 9.8
    CVE-2026-57770

    WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

    ThemeGoods Grand Photography
  • High 7.1
    CVE-2025-69152

    WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

    ThemeGoods Artale | Wedding Photography WordPress Web / CMS
  • High 7.1
    CVE-2025-68524

    WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

    ThemeGoods Avante
  • High 7.1
    CVE-2025-69151

    WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

    ThemeGoods Grand Car Rental
  • Medium 5.4
    CVE-2026-39635

    WordPress Grand Magazine theme <= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.

    ThemeGoods Grand Magazine
  • Medium 5.4
    CVE-2026-39634

    WordPress Grand Portfolio theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.

    ThemeGoods Grand Portfolio
  • Medium 6.5
    CVE-2026-39633

    WordPress Grand Car Rental theme <= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.

    ThemeGoods Grand Car Rental
  • Medium 6.5
    CVE-2026-39632

    WordPress Grand Blog theme <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.

    ThemeGoods Grand Blog
  • Medium 5.4
    CVE-2026-39603

    WordPress Grand Photography theme <= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.

    ThemeGoods Grand Photography
  • High 7.2
    CVE-2026-27043

    WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.

    ThemeGoods Photography
  • High 7.1
    CVE-2026-27367

    WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.

    ThemeGoods Musico
  • High 7.1
    CVE-2026-27358

    WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.

    ThemeGoods Architecturer
  • High 7.1
    CVE-2026-27348

    WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.

    ThemeGoods Photography
  • High 7.1
    CVE-2026-27352

    WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.

    ThemeGoods Starto
  • High 7.1
    CVE-2026-27353

    WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.

    ThemeGoods Grand News Web / CMS
  • Critical 9.8
    CVE-2026-22417

    WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

    ThemeGoods Grand Wedding
  • High 7.1
    CVE-2026-24949

    WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.

    ThemeGoods PhotoMe
  • High 7.1
    CVE-2026-24943

    WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflected XSS.This issue affects Grand Conference: from n/a through <= 5.3.4.

    ThemeGoods Grand Conference
  • Critical 9.8
    CVE-2025-69370

    WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.

    ThemeGoods Capella
  • Critical 9.8
    CVE-2025-69301

    WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.

    ThemeGoods PhotoMe
  • Critical 9.8
    CVE-2026-23542

    WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

    ThemeGoods Grand Restaurant
  • Medium 5.4
    CVE-2026-24961

    WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Server Side Request Forgery.This issue affects Grand Blog: from n/a through < 3.1.5.

    ThemeGoods Grand Blog
  • Medium 5.4
    CVE-2026-24381

    WordPress PhotoMe theme < 5.7.2 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods PhotoMe photome allows Server Side Request Forgery.This issue affects PhotoMe: from n/a through < 5.7.2.

    ThemeGoods PhotoMe
  • High 7.1
    CVE-2025-69320

    WordPress Grand Magazine theme <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affects Grand Magazine: from n/a through <= 3.5.7.

    ThemeGoods Grand Magazine
  • High 7.1
    CVE-2025-69321

    WordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Spa: from n/a through <= 3.5.5.

    ThemeGoods Grand Spa
  • High 7.1
    CVE-2025-68538

    WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through <= 2.3.6.

    ThemeGoods Craft Web / CMS
  • High 7.1
    CVE-2025-68520

    WordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: from n/a through < 4.9.5.

    ThemeGoods DotLife
  • High 7.1
    CVE-2025-68518

    WordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: from n/a through < 6.8.9.

    ThemeGoods Hoteller
  • High 8.1
    CVE-2025-68510

    WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through < 7.7.5.

    ThemeGoods Photography
  • High 7.1
    CVE-2025-67952

    WordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.

    ThemeGoods Grand Tour
  • Medium 6.5
    CVE-2025-63026

    WordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for E…

    ThemeGoods Grand Restaurant Theme Elements for Elementor