Skip to content
OpenAdvisories

Vendor

ThemeGoods

57 known vulnerabilities.

Products

Photography 9 Grand Restaurant 8 Grand Photography 3 Altair 3 Grand Tour 3 Capella 3 PhotoMe 3 Grand Blog 2 Grand Conference 2 Grand Car Rental 2 Grand Magazine 2 Grand Conference Theme Custom Post Type 2 Grand News 2 Hoteller 1 Craft 1 Grand Wedding 1 Grand Restaurant Theme Elements for Elementor 1 Grand Portfolio 1 DK 1 Avante 1 Starto 1 Architecturer 1 Grand Spa 1 Musico 1 Artale | Wedding Photography WordPress 1 DotLife 1
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.8
    CVE-2025-15689

    WordPress Capella theme <= 2.5.5 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

    ThemeGoods Capella
  • Critical 9.3
    CVE-2025-15688

    WordPress Capella theme <= 2.5.5 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

    ThemeGoods Capella
  • Critical 9.8
    CVE-2026-57770

    WordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

    ThemeGoods Grand Photography
  • Critical 9.8
    CVE-2026-22417

    WordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

    ThemeGoods Grand Wedding
  • Critical 9.8
    CVE-2025-69370

    WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.

    ThemeGoods Capella
  • Critical 9.8
    CVE-2025-69301

    WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.

    ThemeGoods PhotoMe
  • Critical 9.8
    CVE-2026-23542

    WordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

    ThemeGoods Grand Restaurant
  • Critical 9.0
    CVE-2025-47579

    WordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.

    ThemeGoods Photography
  • Critical 9.8
    CVE-2025-39485

    WordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.

    ThemeGoods Grand Tour
  • Critical 9.8
    CVE-2025-32926

    WordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.

    ThemeGoods Grand Restaurant Web / CMS
  • Critical 9.8
    CVE-2025-32928

    WordPress Altair theme <= 5.2.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2.

    ThemeGoods Altair
  • Critical 9.8
    CVE-2025-39348

    WordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.

    ThemeGoods Grand Restaurant Web / CMS
  • Critical 9.8
    CVE-2025-39354

    WordPress Grand Conference theme <= 5.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.

    ThemeGoods Grand Conference
  • Critical 9.8
    CVE-2024-12922

    Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current

    The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check within functions.php in all versions up to, and including, 5.2.4. This makes it possible for unauthentica…

    ThemeGoods Altair Web / CMS