Themegrill
31 CVEs across 19 Themegrill products. Browse Themegrill vulnerabilities, severities, and proof-of-concept exploits.
Themegrill products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78290 | Medium | 6.5 | 2026-08-24 | Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions. |
CVE-2026-66606 | High | 7.1 | 2026-08-20 | Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions. |
CVE-2025-9266 | Medium | 4.3 | 2026-08-06 | The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in al… |
CVE-2026-4804 | Medium | 6.4 | 2026-07-03 | The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the… |
CVE-2026-52701 | Medium | 6.5 | 2026-06-26 | Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. |
CVE-2026-54807 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions. |
CVE-2026-49081 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. |
CVE-2026-40726 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. |
CVE-2026-42743 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions. |
CVE-2026-39524 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions. |
CVE-2026-25425 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions. |
CVE-2026-49111 | High | 8.8 | 2026-06-15 | Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation. This issue affects Masteriyo - LMS: from n/a through 2… |
CVE-2026-40730 | Medium | 5.3 | 2026-04-15 | Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-9331 | Medium | 4.3 | 2025-08-22 | The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' fu… |
CVE-2025-9202 | Medium | 4.3 | 2025-08-20 | The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() fu… |
CVE-2025-8595 | Medium | 4.3 | 2025-08-06 | The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function… |
CVE-2024-33939 | Medium | 5.3 | 2025-05-19 | Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - L… |
CVE-2020-36837 | Critical | 9.9 | 2024-10-16 | The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the reset_wizard_actions function… |
CVE-2024-9218 | Medium | 6.1 | 2024-10-02 | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to Refl… |
CVE-2024-39629 | Medium | 5.9 | 2024-08-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue… |
CVE-2024-37432 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Esteem allows Stored XSS.This issue aff… |
CVE-2024-24882 | Critical | 9.8 | 2024-05-17 | Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1… |
CVE-2024-34571 | Medium | 6.5 | 2024-05-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects… |
CVE-2024-33540 | Medium | 6.5 | 2024-04-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects… |
CVE-2024-2500 | Medium | 6.4 | 2024-03-22 | The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insu… |
CVE-2024-1462 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes… |
CVE-2024-1370 | Medium | 5.3 | 2024-03-13 | The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hoo… |
CVE-2024-0679 | Medium | 6.5 | 2024-01-20 | The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the plugin_action_callback() function in all version… |
CVE-2023-3345 | Medium | 6.5 | 2023-07-31 | The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any student… |
CVE-2020-36334 | High | 8.8 | 2021-05-05 | themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database. |
CVE-2020-36333 | Critical | 9.1 | 2021-05-05 | themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook. |