Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how themegoods compares to other vendors in security performance

View Risk Score →

Software

themegoods grand restaurant
8
themegoods photography
7
themegoods grand restaurant wordpress
6
themegoods grand conference wordpress
3
themegoods photography wordpress
3
themegoods grand blog
2
themegoods grand conference
2
themegoods grand magazine
2
themegoods grand photography
2
themegoods grand tour
2
themegoods photome
2
themegoods altair
1
themegoods altair wordpress
1
themegoods architecturer (wordpress theme)
1
themegoods capella
1
themegoods craft
1
themegoods dotlife
1
themegoods grand car rental
1
themegoods grand conference theme
1
themegoods grand conference theme custom post type
1
themegoods grand news
1
themegoods grand portfolio
1
themegoods grand restaurant theme elements for elementor
1
themegoods grand spa
1
themegoods grand tour wordpress
1
themegoods grand wedding
1
themegoods hoteller
1
themegoods musico
1
themegoods starto
1

ThemeGoods Grand ConferenceWordPress Grand Conference theme <= 5.3 - PHP Object Injection vulnerability

Risk 46
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3.

First published (updated )
CVE-2025-39354

ThemeGoods Altair WordpressWordPress Altair theme <= 5.2.2 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2.

First published (updated )
CVE-2025-32928

ThemeGoods Grand RestaurantWordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.

First published (updated )
CVE-2025-39348

ThemeGoods Grand RestaurantWordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerability

Risk 46
Severity
9.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects Grand Restaurant: from n/a through <= 7.0.

First published (updated )
CVE-2025-32926

ThemeGoods Grand TourWordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerability

Risk 46
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.

First published (updated )
CVE-2025-39485

ThemeGoods Grand RestaurantWordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0.10.

First published (updated )
CVE-2026-23542

ThemeGoods PhotoMeWordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods PhotoMe photome allows Object Injection.This issue affects PhotoMe: from n/a through <= 5.6.11.

First published (updated )
CVE-2025-69301

ThemeGoods CapellaWordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Capella capella allows Object Injection.This issue affects Capella: from n/a through <= 2.5.5.

First published (updated )
CVE-2025-69370

ThemeGoods Grand WeddingWordPress Grand Wedding theme < 3.1.11 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through < 3.1.11.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-22417

ThemeGoods Grand PhotographyWordPress Grand Photography theme <= 5.7.8 - PHP Object Injection vulnerability

Risk 86
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

First published (updated )
CVE-2026-57770

ThemeGoods PhotographyWordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability

Risk 75
Severity
9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.

First published (updated )
CVE-2025-47579

ThemeGoods Grand Conference ThemeWordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerability

Risk 79
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.

First published (updated )
CVE-2025-60116

ThemeGoods PhotographyWordPress Photography theme <= 7.5.2 - PHP Object Injection vulnerability

Risk 73
Severity
8.5
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2.

First published (updated )
CVE-2025-47584

ThemeGoods Grand RestaurantWordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability

Risk 39
Severity
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.

First published (updated )
CVE-2025-39352

ThemeGoods PhotographyWordPress Photography theme < 7.7.5 - Local File Inclusion vulnerability

Risk 75
Severity
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through < 7.7.5.

First published (updated )
CVE-2025-68510

ThemeGoods Photography (WordPress theme)WordPress Photography theme < 7.7.6 - Arbitrary File Upload vulnerability

Risk 34
Severity
7.2
Malicious File Upload, Path Traversal
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.

1 / 2
Source: NVD

Remedy

Update the WordPress Photography theme to the latest available version (at least 7.7.6).
First published (updated )
CVE-2026-27043

ThemeGoods Grand Conference Theme Custom Post TypeWordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Reflected XSS.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.

First published (updated )
CVE-2025-64224

wordpress/photographyWordPress Photography theme <= 7.7.2 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows Reflected XSS.This issue affects Photography: from n/a through <= 7.7.2.

First published (updated )
CVE-2025-64217

ThemeGoods Grand RestaurantWordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a through < 7.0.9.

First published (updated )
CVE-2025-67922

ThemeGoods Grand TourWordPress Grand Tour theme < 5.6.2 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Tour grandtour allows Reflected XSS.This issue affects Grand Tour: from n/a through < 5.6.2.

First published (updated )
CVE-2025-67952

ThemeGoods HotellerWordPress Hoteller theme < 6.8.9 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Hoteller hoteller allows Reflected XSS.This issue affects Hoteller: from n/a through < 6.8.9.

First published (updated )
CVE-2025-68518

ThemeGoods CraftWordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through <= 2.3.6.

First published (updated )
CVE-2025-68538

ThemeGoods DotLifeWordPress DotLife theme < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods DotLife dotlife allows Reflected XSS.This issue affects DotLife: from n/a through < 4.9.5.

First published (updated )
CVE-2025-68520

ThemeGoods Grand MagazineWordPress Grand Magazine theme <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected XSS.This issue affects Grand Magazine: from n/a through <= 3.5.7.

First published (updated )
CVE-2025-69320

ThemeGoods Grand SpaWordPress Grand Spa theme <= 3.5.5 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This issue affects Grand Spa: from n/a through <= 3.5.5.

First published (updated )
CVE-2025-69321

ThemeGoods PhotoMeWordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Risk 36
Severity
7.1
EPSS
0.03%
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.

First published (updated )
CVE-2026-24949

ThemeGoods Grand ConferenceWordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability

Risk 36
Severity
7.1
EPSS
0.03%
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflected XSS.This issue affects Grand Conference: from n/a through <= 5.3.4.

First published (updated )
CVE-2026-24943

ThemeGoods PhotographyWordPress Photography theme < 7.7.6 - Cross Site Scripting (XSS) vulnerability

Risk 36
Severity
7.1
EPSS
0.03%
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography allows DOM-Based XSS.This issue affects Photography: from n/a before 7.7.6.

1 / 2
Source: NVD

Remedy

Update the WordPress Photography theme to the latest available version (at least 7.7.6).
First published (updated )
CVE-2026-27348

ThemeGoods MusicoWordPress Musico theme < 3.4.5 - Cross Site Scripting (XSS) vulnerability

Risk 36
Severity
7.1
EPSS
0.03%
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Musico allows Reflected XSS.This issue affects Musico: from n/a before 3.4.5.

1 / 2
Source: NVD

Remedy

Update the WordPress Musico theme to the latest available version (at least 3.4.5).
First published (updated )
CVE-2026-27367

ThemeGoods StartoWordPress Starto theme < 2.2.5 - Cross Site Scripting (XSS) vulnerability

Risk 36
Severity
7.1
EPSS
0.03%
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Starto allows Reflected XSS.This issue affects Starto: from n/a before 2.2.5.

1 / 2
Source: NVD

Remedy

Update the WordPress Starto theme to the latest available version (at least 2.2.5).
First published (updated )
CVE-2026-27352

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203