Skip to content
OpenAdvisories

Vendor

ThemeGrill

41 known vulnerabilities.

Products

User Registration 15 Masteriyo - LMS 4 ColorMag 3 Himalayas 2 ThemeGrill Demo Importer 2 User Registration Stripe 2 Zakra 2 Registration Form for WooCommerce 2 Maintenance Page 2 Magazine Blocks 1 Spacious 1 Esteem 1 Accelerate 1 SmartSMTP 1 ColorNews 1 eStore 1
All Critical High Medium Low Exploited only Public exploit

29 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-119522

    WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.

    ThemeGrill User Registration
  • Medium 5.3
    CVE-2026-124258

    WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1.

    ThemeGrill User Registration
  • Medium 4.3
    CVE-2026-120840

    WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.

    ThemeGrill User Registration
  • Medium 5.3
    CVE-2026-25450

    WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0.

    ThemeGrill User Registration
  • Medium 5.3
    CVE-2026-25467

    WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.

    ThemeGrill User Registration
  • Medium 6.5
    CVE-2026-105882

    WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

    ThemeGrill User Registration
  • Medium 5.4
    CVE-2026-109699

    WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

    ThemeGrill User Registration
  • Medium 5.3
    CVE-2026-106598

    WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.

    ThemeGrill User Registration
  • Medium 6.5
    CVE-2026-105881

    WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

    ThemeGrill User Registration
  • Medium 5.4
    CVE-2026-103076

    WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8.

    ThemeGrill User Registration
  • Medium 5.3
    CVE-2026-106597

    WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

    ThemeGrill User Registration
  • Medium 5.6
    CVE-2026-96334

    WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.

    ThemeGrill User Registration
  • Medium 6.5
    CVE-2026-78290

    WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

    ThemeGrill Magazine Blocks
  • Medium 4.3
    CVE-2025-9266

    Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

    The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Sub…

    ThemeGrill Accelerate Web / CMS
  • Medium 6.4
    CVE-2026-4804

    Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API

    The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and z…

    ThemeGrill Zakra Web / CMS
  • Medium 6.5
    CVE-2026-52701

    WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

    ThemeGrill User Registration
  • Medium 6.5
    CVE-2026-42743

    WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability

    Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

    ThemeGrill Masteriyo - LMS
  • Medium 5.3
    CVE-2026-40730

    WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.

    ThemeGrill ThemeGrill Demo Importer
  • Medium 4.3
    CVE-2025-9331

    Spacious <= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import

    The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attack…

    ThemeGrill Spacious Web / CMS
  • Medium 4.3
    CVE-2025-9202

    ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

    The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attack…

    ThemeGrill ColorMag Web / CMS
  • Medium 4.3
    CVE-2025-8595

    Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import

    The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, wi…

    ThemeGrill Zakra Web / CMS
  • Medium 5.9
    CVE-2024-39629

    WordPress Himalayas theme <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.2.

    ThemeGrill Himalayas
  • Medium 5.9
    CVE-2024-37432

    WordPress Esteem theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Esteem allows Stored XSS.This issue affects Esteem: from n/a through 1.5.0.

    ThemeGrill Esteem
  • Medium 6.5
    CVE-2024-34571

    WordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.0.

    ThemeGrill Himalayas
  • Medium 6.5
    CVE-2024-33540

    WordPress ColorNews theme <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects ColorNews: from n/a through 1.2.6.

    ThemeGrill ColorNews
  • Medium 6.4
    CVE-2024-2500

    ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name

    The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers,…

    ThemeGrill ColorMag Web / CMS
  • Medium 5.3
    CVE-2024-1462

    Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API

    The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in mainte…

    ThemeGrill Maintenance Page Web / CMS
  • Medium 5.3
    CVE-2024-1370

    Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information Exposure

    The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hooked via AJAX action in all versions up to, and including, 1.0.8. This makes it possible for authenti…

    ThemeGrill Maintenance Page Web / CMS
  • Medium 6.5
    CVE-2024-0679 Public exploit

    ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation

    The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-l…

    ThemeGrill ColorMag Web / CMS