Skip to content
OpenAdvisories

Vendor

ThemeGoods

57 known vulnerabilities.

Products

Photography 9 Grand Restaurant 8 Grand Photography 3 Altair 3 Grand Tour 3 Capella 3 PhotoMe 3 Grand Blog 2 Grand Conference 2 Grand Car Rental 2 Grand Magazine 2 Grand Conference Theme Custom Post Type 2 Grand News 2 Hoteller 1 Craft 1 Grand Wedding 1 Grand Restaurant Theme Elements for Elementor 1 Grand Portfolio 1 DK 1 Avante 1 Starto 1 Architecturer 1 Grand Spa 1 Musico 1 Artale | Wedding Photography WordPress 1 DotLife 1
All Critical High Medium Low Exploited only Public exploit

27 results · Clear filters · Feed

  • High 7.5
    CVE-2026-42706

    WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

    ThemeGoods DK
  • High 7.5
    CVE-2026-42705

    WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

    ThemeGoods Grand News
  • High 7.1
    CVE-2026-94161

    WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

    ThemeGoods Grand Restaurant
  • High 7.1
    CVE-2026-57769

    WordPress Grand Photography theme <= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

    ThemeGoods Grand Photography
  • High 7.1
    CVE-2025-69152

    WordPress Artale | Wedding Photography WordPress theme <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

    ThemeGoods Artale | Wedding Photography WordPress Web / CMS
  • High 7.1
    CVE-2025-68524

    WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions.

    ThemeGoods Avante
  • High 7.1
    CVE-2025-69151

    WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

    ThemeGoods Grand Car Rental
  • High 7.2
    CVE-2026-27043

    WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.

    ThemeGoods Photography
  • High 7.1
    CVE-2026-27367

    WordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico musico allows Reflected XSS.This issue affects Musico: from n/a through < 3.4.5.

    ThemeGoods Musico
  • High 7.1
    CVE-2026-27358

    WordPress Architecturer theme < 3.9.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Architecturer architecturer allows Reflected XSS.This issue affects Architecturer: from n/a through < 3.9.5.

    ThemeGoods Architecturer
  • High 7.1
    CVE-2026-27348

    WordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows DOM-Based XSS.This issue affects Photography: from n/a through < 7.7.6.

    ThemeGoods Photography
  • High 7.1
    CVE-2026-27352

    WordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto starto allows Reflected XSS.This issue affects Starto: from n/a through < 2.2.5.

    ThemeGoods Starto
  • High 7.1
    CVE-2026-27353

    WordPress Grand News | Magazine Newspaper WordPress theme <= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand News grandnews allows Reflected XSS.This issue affects Grand News: from n/a through <= 3.4.3.

    ThemeGoods Grand News Web / CMS
  • High 7.1
    CVE-2026-24949

    WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.

    ThemeGoods PhotoMe
  • High 7.1
    CVE-2026-24943

    WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflected XSS.This issue affects Grand Conference: from n/a through <= 5.3.4.

    ThemeGoods Grand Conference
  • High 7.1
    CVE-2025-69320

    WordPress Grand Magazine theme <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affects Grand Magazine: from n/a through <= 3.5.7.

    ThemeGoods Grand Magazine
  • High 7.1
    CVE-2025-69321

    WordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Spa: from n/a through <= 3.5.5.

    ThemeGoods Grand Spa
  • High 7.1
    CVE-2025-68538

    WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through <= 2.3.6.

    ThemeGoods Craft Web / CMS
  • High 7.1
    CVE-2025-68520

    WordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: from n/a through < 4.9.5.

    ThemeGoods DotLife
  • High 7.1
    CVE-2025-68518

    WordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: from n/a through < 6.8.9.

    ThemeGoods Hoteller
  • High 8.1
    CVE-2025-68510

    WordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through < 7.7.5.

    ThemeGoods Photography
  • High 7.1
    CVE-2025-67952

    WordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.

    ThemeGoods Grand Tour
  • High 7.1
    CVE-2025-67922

    WordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a through < 7.0.9.

    ThemeGoods Grand Restaurant
  • High 7.1
    CVE-2025-64217

    WordPress Photography theme <= 7.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows Reflected XSS.This issue affects Photography: from n/a through <= 7.7.2.

    ThemeGoods Photography
  • High 7.1
    CVE-2025-64224

    WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Reflected XSS.This issue affects Grand Conference Theme Custom Post Typ…

    ThemeGoods Grand Conference Theme Custom Post Type
  • High 8.5
    CVE-2025-47584

    WordPress Photography theme <= 7.5.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2.

    ThemeGoods Photography
  • High 8.2
    CVE-2025-39352

    WordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability

    Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.

    ThemeGoods Grand Restaurant Web / CMS