# cve.now: Themegoods

The newest entries naming Themegoods as an affected vendor (up to 200), of 57 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-42706](https://cve.now/CVE-2026-42706.md): WordPress DK theme \<= 3.2.1 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-42705](https://cve.now/CVE-2026-42705.md): WordPress Grand News theme \<= 3.4 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-94161](https://cve.now/CVE-2026-94161.md): WordPress Grand Restaurant theme \< 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66652](https://cve.now/CVE-2026-66652.md): WordPress Grand Tour theme \<= 5.5.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2025-53999](https://cve.now/CVE-2025-53999.md): WordPress Altair theme \<= 5.2.2 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-15689](https://cve.now/CVE-2025-15689.md): WordPress Capella theme \<= 2.5.5 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2025-15688](https://cve.now/CVE-2025-15688.md): WordPress Capella theme \<= 2.5.5 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-65487](https://cve.now/CVE-2026-65487.md): WordPress Photography theme \<= 7.7.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-57769](https://cve.now/CVE-2026-57769.md): WordPress Grand Photography theme \<= 5.7.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57770](https://cve.now/CVE-2026-57770.md): WordPress Grand Photography theme \<= 5.7.8 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-69152](https://cve.now/CVE-2025-69152.md): WordPress Artale | Wedding Photography WordPress theme \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68524](https://cve.now/CVE-2025-68524.md): WordPress Avante theme \< 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-69151](https://cve.now/CVE-2025-69151.md): WordPress Grand Car Rental theme \<= 3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-39635](https://cve.now/CVE-2026-39635.md): WordPress Grand Magazine theme \<= 3.5.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-39634](https://cve.now/CVE-2026-39634.md): WordPress Grand Portfolio theme \<= 3.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-39633](https://cve.now/CVE-2026-39633.md): WordPress Grand Car Rental theme \<= 3.6.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5)
- [CVE-2026-39632](https://cve.now/CVE-2026-39632.md): WordPress Grand Blog theme \<= 3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5)
- [CVE-2026-39603](https://cve.now/CVE-2026-39603.md): WordPress Grand Photography theme \<= 5.7.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-27043](https://cve.now/CVE-2026-27043.md): WordPress Photography theme \< 7.7.6 - Arbitrary File Upload vulnerability (CVSS 7.2)
- [CVE-2026-27367](https://cve.now/CVE-2026-27367.md): WordPress Musico theme \< 3.4.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27358](https://cve.now/CVE-2026-27358.md): WordPress Architecturer theme \< 3.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27353](https://cve.now/CVE-2026-27353.md): WordPress Grand News | Magazine Newspaper WordPress theme \<= 3.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27352](https://cve.now/CVE-2026-27352.md): WordPress Starto theme \< 2.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-27348](https://cve.now/CVE-2026-27348.md): WordPress Photography theme \< 7.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-22417](https://cve.now/CVE-2026-22417.md): WordPress Grand Wedding theme \< 3.1.11 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-24949](https://cve.now/CVE-2026-24949.md): WordPress PhotoMe theme \<= 5.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-24943](https://cve.now/CVE-2026-24943.md): WordPress Grand Conference theme \<= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-69370](https://cve.now/CVE-2025-69370.md): WordPress Capella theme \<= 2.5.5 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-69301](https://cve.now/CVE-2025-69301.md): WordPress PhotoMe theme \<= 5.6.11 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-23542](https://cve.now/CVE-2026-23542.md): WordPress Grand Restaurant theme \<= 7.0.10 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-24961](https://cve.now/CVE-2026-24961.md): WordPress Grand Blog theme \< 3.1.5 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4)
- [CVE-2026-24381](https://cve.now/CVE-2026-24381.md): WordPress PhotoMe theme \< 5.7.2 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4)
- [CVE-2025-69321](https://cve.now/CVE-2025-69321.md): WordPress Grand Spa theme \<= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-69320](https://cve.now/CVE-2025-69320.md): WordPress Grand Magazine theme \<= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68538](https://cve.now/CVE-2025-68538.md): WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme \<= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68520](https://cve.now/CVE-2025-68520.md): WordPress DotLife theme \< 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68518](https://cve.now/CVE-2025-68518.md): WordPress Hoteller theme \< 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-68510](https://cve.now/CVE-2025-68510.md): WordPress Photography theme \< 7.7.5 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-67952](https://cve.now/CVE-2025-67952.md): WordPress Grand Tour theme \< 5.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-63026](https://cve.now/CVE-2025-63026.md): WordPress Grand Restaurant Theme Elements for Elementor plugin \<= 2.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-67922](https://cve.now/CVE-2025-67922.md): WordPress Grand Restaurant theme \< 7.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-64217](https://cve.now/CVE-2025-64217.md): WordPress Photography theme \<= 7.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-64224](https://cve.now/CVE-2025-64224.md): WordPress Grand Conference Theme Custom Post Type plugin \< 2.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-60116](https://cve.now/CVE-2025-60116.md): WordPress Grand Conference Theme Custom Post Type plugin \< 2.6.4 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-47579](https://cve.now/CVE-2025-47579.md): WordPress Photography Theme \<= 7.7.2 - PHP Object Injection Vulnerability (CVSS 9.0)
- [CVE-2025-47584](https://cve.now/CVE-2025-47584.md): WordPress Photography theme \<= 7.5.2 - PHP Object Injection vulnerability (CVSS 8.5)
- [CVE-2025-39485](https://cve.now/CVE-2025-39485.md): WordPress GrandTour theme \<= 5.6 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-32926](https://cve.now/CVE-2025-32926.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Path Traversal to PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-32928](https://cve.now/CVE-2025-32928.md): WordPress Altair theme \<= 5.2.2 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-39348](https://cve.now/CVE-2025-39348.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-39352](https://cve.now/CVE-2025-39352.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Arbitrary Options Deletion vulnerability (CVSS 8.2)
- [CVE-2025-39354](https://cve.now/CVE-2025-39354.md): WordPress Grand Conference theme \<= 5.3 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-39353](https://cve.now/CVE-2025-39353.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-39351](https://cve.now/CVE-2025-39351.md): WordPress Grand Restaurant WordPress theme \<= 7.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-30964](https://cve.now/CVE-2025-30964.md): WordPress Photography theme \< 7.7.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4)
- [CVE-2024-12922](https://cve.now/CVE-2024-12922.md): Altair \<= 5.2.4 - Unauthenticated Arbitrary Options Update via pp\_import\_current (CVSS 9.8)
- [CVE-2025-22702](https://cve.now/CVE-2025-22702.md): WordPress Photography Theme \<= 7.7.2 - Broken Access Control Vulnerability (CVSS 6.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themegoods
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.