Themegrill vulnerabilities, page 2
40 vulnerabilities
Known vulnerabilities in Themegrill products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 17 products.
CVE-2024-39629themegrillhimalayas+1
EPSS score0.26%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.2.CVE-2024-37432themegrillesteem+1EPSS score0.26%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThemeGrill Esteem allows Stored XSS.This issue affects Esteem: from n/a through 1.5.0.CVE-2024-24882masteriyomasteriyo - lms+2EPSS score2.09%
Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.2.CVE-2024-34571themegrillhimalayas+1EPSS score0.25%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill Himalayas allows Stored XSS.This issue affects Himalayas: from n/a through 1.3.0.CVE-2024-33939masteriyomasteriyo - lms+2EPSS score0.94%
Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.CVE-2024-33540themegrillcolornews+1EPSS score0.34%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects ColorNews: from n/a through 1.2.6.CVE-2026-54807themegrillregistration form for woocommerce+1EPSS score0.48%
Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.CVE-2026-40726themegrilluser registration stripe+1EPSS score0.34%
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.CVE-2026-40730themegrillthemegrill_demo_importer+1EPSS score0.31%
Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.CVE-2026-52701themegrilluser registration+1EPSS score0.27%
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.CVE-2026-42743themegrillmasteriyo - lms+1EPSS score0.20%
Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.CVE-2026-4804themegrillzakra+1EPSS score0.28%
The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.CVE-2026-39524themegrillmasteriyo - lms+1EPSS score0.35%
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.CVE-2026-25425themegrilluser registration+1EPSS score0.37%
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.CVE-2026-66606themegrillsmartsmtp+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.CVE-2026-49111themegrillmasteriyo - lms+1EPSS score0.42%
Incorrect Privilege Assignment vulnerability in ThemeGrill Masteriyo - LMS allows Privilege Escalation.
This issue affects Masteriyo - LMS: from n/a through 2.2.0.CVE-2026-49081themegrilluser registration stripe+1EPSS score0.32%
Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.CVE-2026-96334themegrilluser registration+1EPSS score0.15%
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.CVE-2026-78290themegrillmagazine_blocks+1EPSS score0.22%
Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.CVE-2023-3345themegrillmasteriyo+2EPSS score1.97%
The LMS by Masteriyo WordPress plugin before 1.6.8 does not have proper authorization in one some of its REST API endpoints, making it possible for any students to retrieve email addresses of other students