Log in Start free

ThemeGrill

Products

ProductCVEsExploitedLatest
User Registration13–Nov 7, 2026
Masteriyo - LMS4–Aug 18, 2026
ColorMag3–Aug 20, 2025
Zakra2–Jul 3, 2026
Himalayas2–Aug 1, 2024
Maintenance Page2–Mar 13, 2024
ThemeGrill Demo Importer2–Apr 15, 2026
User Registration Stripe2–Jun 17, 2026
Esteem1–Jul 22, 2024
Registration Form for WooCommerce1–Jun 17, 2026
SmartSMTP1–Aug 20, 2026
Spacious1–Aug 22, 2025
eStore1–Oct 18, 2026
Accelerate1–Aug 6, 2026
Magazine Blocks1–Aug 24, 2026
ColorNews1–Apr 29, 2024

Exploited and recent CVEs

  • CVE-2026-120840 Medium 4.3 WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability –
  • CVE-2026-25450 Medium 5.3 WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability 0.2%
  • CVE-2026-25467 Medium 5.3 WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability 0.3%
  • CVE-2026-108485 High 7.1 WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-105882 Medium 6.5 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-109692 High 7.1 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability 0.2%
  • CVE-2026-109699 Medium 5.4 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability 0.2%
  • CVE-2026-106598 Medium 5.3 WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability 0.2%
  • CVE-2026-105881 Medium 6.5 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-103076 Medium 5.4 WordPress User Registration plugin <= 5.2.8 - Cross Site Request Forgery (CSRF) vulnerability 0.1%
  • CVE-2026-106597 Medium 5.3 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability 0.2%
  • CVE-2026-96334 Medium 5.6 WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability 0.1%
  • CVE-2026-78290 Medium 6.5 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-66606 High 7.1 WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-73996 Critical 9.8 WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability 0.5%
  • CVE-2025-9266 Medium 4.3 Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation 0.3%
  • CVE-2026-4804 Medium 6.4 Zakra <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta REST API 0.3%
  • CVE-2026-52701 Medium 6.5 WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-54807 Critical 9.8 WordPress Registration Form for WooCommerce plugin <= 1.0.9 - Privilege Escalation vulnerability 0.3%
  • CVE-2026-49081 High 8.2 WordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability 0.3%
  • CVE-2026-40726 High 8.2 WordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability 0.2%
  • CVE-2026-42743 Medium 6.5 WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability 0.1%
  • CVE-2026-39524 High 7.5 WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability 0.2%
  • CVE-2026-25425 High 7.5 WordPress User Registration plugin <= 5.1.2 - Broken Access Control vulnerability 0.4%
  • CVE-2026-49111 High 8.8 WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability 0.2%
  • CVE-2026-40730 Medium 5.3 WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability 0.2%
  • CVE-2025-9331 Medium 4.3 Spacious <= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import 0.3%
  • CVE-2025-9202 Medium 4.3 ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation 0.2%
  • CVE-2025-8595 Medium 4.3 Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import 0.2%
  • CVE-2020-36837 Critical 9.9 ThemeGrill Demo Importer 1.3.4 - 1.6.1 - Authorization Bypass to Site Reset 0.6%