TH
Vendor
Themegrill
42
CVEs
0
On KEV
11
New 30D
Products
UR7.5
User Registration
Themegrill
12 CVEs0 on KEV10 new
ES7.1
eStore
ThemeGrill
1 CVEs0 on KEV1 new
TD9.9
ThemeGrill Demo Importer
themegrill
4 CVEs0 on KEV0 new
CO6.5
ColorMag
themegrill
3 CVEs0 on KEV0 new
MA9.8
Masteriyo
Themegrill
3 CVEs0 on KEV0 new
ML8.8
Masteriyo - LMS
ThemeGrill
3 CVEs0 on KEV0 new
HI6.5
Himalayas
ThemeGrill
2 CVEs0 on KEV0 new
MB6.5
Magazine Blocks
ThemeGrill
2 CVEs0 on KEV0 new
MP5.3
Maintenance Page
themegrill
2 CVEs0 on KEV0 new
UR8.2
User Registration Stripe
ThemeGrill
2 CVEs0 on KEV0 new
ZA6.4
Zakra
themegrill
2 CVEs0 on KEV0 new
AC4.3
Accelerate
themegrill
1 CVEs0 on KEV0 new
CO6.5
ColorNews
ThemeGrill
1 CVEs0 on KEV0 new
ES6.1
Esteem
ThemeGrill
1 CVEs0 on KEV0 new
RF9.8
Registration Form for WooCommerce
ThemeGrill
1 CVEs0 on KEV0 new
SM7.1
SmartSMTP
ThemeGrill
1 CVEs0 on KEV0 new
SP4.3
Spacious
themegrill
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-25450 New | UR User Registration ThemeGrill | 5.3 | Oct 29 | WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability |
| CVE-2026-25467 New | UR User Registration ThemeGrill | 5.3 | Oct 29 | WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability |
| CVE-2026-108485 | ES eStore ThemeGrill | 7.1 | Oct 18 | WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-105882 | UR User Registration ThemeGrill | 6.5 | Oct 15 | WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-109692 | UR User Registration ThemeGrill | 7.1 | Oct 15 | WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability |
| CVE-2026-109699 | UR User Registration ThemeGrill | 5.4 | Oct 13 | WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability |
| CVE-2026-106598 | UR User Registration ThemeGrill | 5.3 | Oct 13 | WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability |
| CVE-2026-105881 | UR User Registration ThemeGrill | 6.5 | Oct 13 | WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-103076 | UR User Registration ThemeGrill | 5.4 | Oct 13 | WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2026-106597 | UR User Registration ThemeGrill | 5.3 | Oct 13 | WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability |
| CVE-2026-96334 | UR User Registration ThemeGrill | 5.6 | Oct 9 | WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability |
| CVE-2026-78290 | MB Magazine Blocks ThemeGrill | 6.5 | Aug 24 | WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-66606 | SM SmartSMTP ThemeGrill | 7.1 | Aug 20 | WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-9266 | AC Accelerate themegrill | 4.3 | Aug 6 | Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation |
| CVE-2026-4804 | ZA Zakra themegrill | 6.4 | Jul 3 | Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API |
| CVE-2026-52701 | UR User Registration Themegrill | 6.5 | Jun 26 | WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability |
| CVE-2026-54807 | RF Registration Form for WooCommerce ThemeGrill | 9.8 | Jun 17 | WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability |
| CVE-2026-49081 | UR User Registration Stripe ThemeGrill | 8.2 | Jun 17 | WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability |
| CVE-2026-40726 | UR User Registration Stripe ThemeGrill | 8.2 | Jun 17 | WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability |
| CVE-2026-42743 | ML Masteriyo - LMS ThemeGrill | 6.5 | Jun 15 | WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability |
| CVE-2026-39524 | ML Masteriyo - LMS ThemeGrill | 7.5 | Jun 15 | WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability |
| CVE-2026-25425 | UR User Registration ThemeGrill | 7.5 | Jun 15 | WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability |
| CVE-2026-49111 | ML Masteriyo - LMS ThemeGrill | 8.8 | Jun 15 | WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability |
| CVE-2026-40730 | TD ThemeGrill Demo Importer ThemeGrill | 5.3 | Apr 15 | WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability |
| CVE-2025-9331 | SP Spacious themegrill | 4.3 | Aug 22 | Spacious <= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import |
| CVE-2025-9202 | CO ColorMag themegrill | 4.3 | Aug 20 | ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation |
| CVE-2025-8595 | ZA Zakra themegrill | 4.3 | Aug 6 | Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import |
| CVE-2024-33939 | MA Masteriyo Themegrill | 5.3 | May 19 | WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability |
| CVE-2020-36837 | TD ThemeGrill Demo Importer themegrill | 9.9 | Oct 16 | ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset |
| CVE-2024-9218 | MB Magazine Blocks Themegrill | 6.1 | Oct 2 | Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.3.14 - Reflected Cross-Site Scripting |
| CVE-2024-39629 | HI Himalayas ThemeGrill | 4.8 | Aug 1 | WordPress Himalayas theme <= 1.3.2 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-37432 | ES Esteem ThemeGrill | 6.1 | Jul 22 | WordPress Esteem theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-24882 | MA Masteriyo Themegrill | 9.8 | May 17 | WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability |
| CVE-2024-34571 | HI Himalayas ThemeGrill | 6.5 | May 8 | WordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-33540 | CO ColorNews ThemeGrill | 6.5 | Apr 29 | WordPress ColorNews theme <= 1.2.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-2500 | CO ColorMag themegrill | 6.4 | Mar 22 | ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name |
| CVE-2024-1462 | MP Maintenance Page themegrill | 5.3 | Mar 13 | Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API |
| CVE-2024-1370 | MP Maintenance Page themegrill | 4.3 | Mar 13 | Maintenance Page <= 1.0.8 - Missing Authorization to Sensitive Information Exposure |
| CVE-2024-0679 | CO ColorMag themegrill | 6.5 | Jan 20 | ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation |
| CVE-2023-3345 | MA Masteriyo Themegrill | 6.5 | Jul 31 | LMS by Masteriyo < 1.6.8 - Information Exposure |
| CVE-2020-36334 | TD Themegrill Demo Importer Themegrill | 8.8 | May 5 | themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database |
| CVE-2020-36333 | TD Themegrill Demo Importer Themegrill | 9.1 | May 5 | themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a reset_wizard_actions hook |