# cve.now: Themegrill

The newest entries naming Themegrill as an affected vendor (up to 200), of 41 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119522](https://cve.now/CVE-2026-119522.md): WordPress User Registration plugin \<= 5.3.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-124258](https://cve.now/CVE-2026-124258.md): WordPress User Registration plugin \<= 5.3.1 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-119075](https://cve.now/CVE-2026-119075.md): Registration Form for WooCommerce \<= 1.1.4 - Unauthenticated Privilege Escalation to 'user\_roles' Parameter at Checkout (CVSS 9.8)
- [CVE-2026-120840](https://cve.now/CVE-2026-120840.md): WordPress User Registration plugin \<= 5.3.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-25450](https://cve.now/CVE-2026-25450.md): WordPress User Registration plugin \<= 5.3.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-25467](https://cve.now/CVE-2026-25467.md): WordPress User Registration plugin \<= 5.3.0 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2026-108485](https://cve.now/CVE-2026-108485.md): WordPress eStore theme \<= 1.6.13 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-105882](https://cve.now/CVE-2026-105882.md): WordPress User Registration plugin \<= 5.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-109692](https://cve.now/CVE-2026-109692.md): WordPress User Registration plugin \<= 5.2.8 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2026-109699](https://cve.now/CVE-2026-109699.md): WordPress User Registration plugin \<= 5.2.8 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-106598](https://cve.now/CVE-2026-106598.md): WordPress User Registration plugin \<= 5.2.8 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2026-105881](https://cve.now/CVE-2026-105881.md): WordPress User Registration plugin \<= 5.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-103076](https://cve.now/CVE-2026-103076.md): WordPress User Registration plugin \<= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-106597](https://cve.now/CVE-2026-106597.md): WordPress User Registration plugin \<= 5.2.8 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-96334](https://cve.now/CVE-2026-96334.md): WordPress User Registration plugin \<= 5.2.7 - Broken Access Control vulnerability (CVSS 5.6)
- [CVE-2026-78290](https://cve.now/CVE-2026-78290.md): WordPress Magazine Blocks plugin \<= 1.8.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-66606](https://cve.now/CVE-2026-66606.md): WordPress SmartSMTP plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-73996](https://cve.now/CVE-2026-73996.md): WordPress Masteriyo - LMS plugin \<= 2.3.2 - Arbitrary File Upload vulnerability (CVSS 9.8)
- [CVE-2025-9266](https://cve.now/CVE-2025-9266.md): Accelerate \<= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation (CVSS 4.3)
- [CVE-2026-4804](https://cve.now/CVE-2026-4804.md): Zakra \<= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API (CVSS 6.4)
- [CVE-2026-52701](https://cve.now/CVE-2026-52701.md): WordPress User Registration plugin \<= 5.2.2 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-54807](https://cve.now/CVE-2026-54807.md): WordPress Registration Form for WooCommerce plugin \<= 1.0.9 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-49081](https://cve.now/CVE-2026-49081.md): WordPress User Registration Stripe plugin \<= 1.3.12 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2026-40726](https://cve.now/CVE-2026-40726.md): WordPress User Registration Stripe plugin \<= 1.3.14 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2026-42743](https://cve.now/CVE-2026-42743.md): WordPress Masteriyo - LMS plugin \<= 2.1.8 - Broken Authentication vulnerability (CVSS 6.5)
- [CVE-2026-39524](https://cve.now/CVE-2026-39524.md): WordPress Masteriyo - LMS plugin \<= 2.1.5 - Payment Bypass vulnerability (CVSS 7.5)
- [CVE-2026-25425](https://cve.now/CVE-2026-25425.md): WordPress User Registration plugin \<= 5.1.2 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-49111](https://cve.now/CVE-2026-49111.md): WordPress Masteriyo - LMS plugin \<= 2.2.0 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2026-40730](https://cve.now/CVE-2026-40730.md): WordPress ThemeGrill Demo Importer plugin \<= 2.0.0.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-9331](https://cve.now/CVE-2025-9331.md): Spacious \<= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import (CVSS 4.3)
- [CVE-2025-9202](https://cve.now/CVE-2025-9202.md): ColorMag \<= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation (CVSS 4.3)
- [CVE-2025-8595](https://cve.now/CVE-2025-8595.md): Zakra \<= 4.1.5 - Missing Authorization to Subscriber+ Demo Import (CVSS 4.3)
- [CVE-2020-36837](https://cve.now/CVE-2020-36837.md): ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset (CVSS 9.9)
- [CVE-2024-39629](https://cve.now/CVE-2024-39629.md): WordPress Himalayas theme \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-37432](https://cve.now/CVE-2024-37432.md): WordPress Esteem theme \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-34571](https://cve.now/CVE-2024-34571.md): WordPress Himalayas theme \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-33540](https://cve.now/CVE-2024-33540.md): WordPress ColorNews theme \<= 1.2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-2500](https://cve.now/CVE-2024-2500.md): ColorMag \<= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name (CVSS 6.4)
- [CVE-2024-1462](https://cve.now/CVE-2024-1462.md): Maintenance Page \<= 1.0.8 - Security Mechanism Bypass via REST API (CVSS 5.3)
- [CVE-2024-1370](https://cve.now/CVE-2024-1370.md): Maintenance Page \<= 1.0.8 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-0679](https://cve.now/CVE-2024-0679.md): ColorMag \<= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themegrill
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.