# cve.now: G5theme

The newest entries naming G5theme as an affected vendor (up to 200), of 34 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-32465](https://cve.now/CVE-2026-32465.md): WordPress Essential Real Estate plugin \<= 5.3.3 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-39714](https://cve.now/CVE-2026-39714.md): WordPress G5Plus April theme \<= 6.8 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-39668](https://cve.now/CVE-2026-39668.md): WordPress Book Previewer for Woocommerce plugin \<= 1.0.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-27088](https://cve.now/CVE-2026-27088.md): WordPress Darna Framework plugin \<= 2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27087](https://cve.now/CVE-2026-27087.md): WordPress Wolverine Framework plugin \<= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-22520](https://cve.now/CVE-2026-22520.md): WordPress Handmade Framework plugin \<= 3.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-69096](https://cve.now/CVE-2025-69096.md): WordPress Zorka theme \<= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-22521](https://cve.now/CVE-2026-22521.md): WordPress Handmade Framework plugin \<= 3.9 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-0676](https://cve.now/CVE-2026-0676.md): WordPress Zorka theme \<= 1.5.7 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-68071](https://cve.now/CVE-2025-68071.md): WordPress Essential Real Estate plugin \<= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2025-66127](https://cve.now/CVE-2025-66127.md): WordPress Essential Real Estate plugin \<= 5.3.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-53352](https://cve.now/CVE-2025-53352.md): WordPress Grid Plus plugin \<= 3.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-48126](https://cve.now/CVE-2025-48126.md): WordPress Essential Real Estate plugin \<= 5.2.9 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2024-13418](https://cve.now/CVE-2024-13418.md): Smart Framework \<= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2024-13420](https://cve.now/CVE-2024-13420.md): Smart Framework \<= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates (CVSS 4.3)
- [CVE-2024-13419](https://cve.now/CVE-2024-13419.md): Smart Framework \<= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-32672](https://cve.now/CVE-2025-32672.md): WordPress Ultimate Bootstrap Elements for Elementor plugin \<= 1.4.9 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-30849](https://cve.now/CVE-2025-30849.md): WordPress Essential Real Estate plugin \<= 5.2.0 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-24698](https://cve.now/CVE-2025-24698.md): WordPress Essential Real Estate plugin \<= 5.1.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2023-34014](https://cve.now/CVE-2023-34014.md): WordPress Grid Plus plugin \<= 1.3.2 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-12329](https://cve.now/CVE-2024-12329.md): Essential Real Estate \<= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure (CVSS 4.3)
- [CVE-2024-10910](https://cve.now/CVE-2024-10910.md): Grid Plus – Unlimited grid layout \<= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid\_plus\_load\_by\_category (CVSS 7.3)
- [CVE-2024-10329](https://cve.now/CVE-2024-10329.md): Ultimate Bootstrap Elements for Elementor \<= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2024-43140](https://cve.now/CVE-2024-43140.md): WordPress Ultimate Bootstrap Elements for Elementor plugin \<= 1.4.4 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2024-37462](https://cve.now/CVE-2024-37462.md): WordPress Ultimate Bootstrap Elements for Elementor plugin \<= 1.4.2 - Local File Inclusion vulnerability (CVSS 8.5)
- [CVE-2024-4273](https://cve.now/CVE-2024-4273.md): Essential Real Estate \<= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-4274](https://cve.now/CVE-2024-4274.md): Essential Real Estate \<= 4.4.2 - Insecure Direct Object Reference to Arbitrary Attachment Deletion (CVSS 4.3)
- [CVE-2024-2132](https://cve.now/CVE-2024-2132.md): Ultimate Bootstrap Elements for Elementor \<= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Widget (CVSS 6.4)
- [CVE-2024-1398](https://cve.now/CVE-2024-1398.md): Ultimate Bootstrap Elements for Elementor \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-24797](https://cve.now/CVE-2024-24797.md): WordPress ERE Recently Viewed Plugin \<= 1.3 is vulnerable to PHP Object Injection (CVSS 9.8)
- [CVE-2023-6827](https://cve.now/CVE-2023-6827.md): Essential Real Estate \<= 4.3.5 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5)
- [CVE-2023-5251](https://cve.now/CVE-2023-5251.md): Grid Plus \<= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete (CVSS 5.4)
- [CVE-2023-5250](https://cve.now/CVE-2023-5250.md): Grid Plus \<= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode (CVSS 8.8)
- [CVE-2023-46209](https://cve.now/CVE-2023-46209.md): WordPress Grid Plus Plugin \<= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/g5theme
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.