Threat database

CVE-2026-42706 is a high-severity vulnerability in ThemeGoods DK versions up to 3.2.1, involving missing authorization controls. This unauthenticated broken access control flaw allows unauthorized users to perform actions that should require authorization, potentially leading to integrity impacts. No patch information is provided, and no known exploits are reported in the wild.

CVE-2026-42705 is a high severity vulnerability in ThemeGoods Grand News versions up to 3.4 that involves missing authorization controls. This unauthenticated broken access control flaw allows an attacker to perform unauthorized actions that impact the integrity of the application. No patch information is currently provided, and no known exploits are reported in the wild.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.

CVE-2025-53999 is a medium severity vulnerability in ThemeGoods Altair versions up to 5.2.2. It involves unauthenticated broken access control, classified as CWE-862, which allows unauthorized users to perform actions they should not be permitted to. The vulnerability does not impact confidentiality but can lead to integrity and availability issues. No patch or remediation details are currently provided.

CVE-2025-15689 is a critical unauthenticated privilege escalation vulnerability in ThemeGoods Capella affecting versions up to and including 2.5.5. It allows an attacker with no prior authentication to gain elevated privileges, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2025-15688 is a critical unauthenticated SQL Injection vulnerability affecting ThemeGoods Capella versions up to and including 2.5.5. This flaw allows remote attackers to inject SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. The vulnerability has a CVSS score of 9.3, indicating a severe risk. No patch or remediation information is currently provided.

Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions.

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through <= 5.7.8.

Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions.

ThemeGoods Avante versions prior to 3.0.5 contain an unauthenticated cross-site scripting (XSS) vulnerability. This vulnerability allows attackers to inject malicious scripts during web page generation due to improper input neutralization. The issue affects all versions before 3.0.5. The vulnerability has a CVSS score of 7.1, indicating high severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Magazine grandmagazine allows Cross Site Request Forgery.This issue affects Grand Magazine: from n/a through <= 3.5.5.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Portfolio grandportfolio allows Cross Site Request Forgery.This issue affects Grand Portfolio: from n/a through <= 3.3.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Car Rental grandcarrental allows Cross Site Request Forgery.This issue affects Grand Car Rental: from n/a through <= 3.6.9.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Cross Site Request Forgery.This issue affects Grand Blog: from n/a through <= 3.1.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issue affects Grand Photography: from n/a through <= 5.7.8.

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography allows Path Traversal.This issue affects Photography: from n/a before 7.7.6.