Threat database

CVE-2026-108485 is a reflected cross-site scripting (XSS) vulnerability in the ThemeGrill eStore plugin affecting versions prior to 1.6.14. It allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected site. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-105882 is a stored cross-site scripting (XSS) vulnerability in the ThemeGrill User Registration plugin affecting versions from initial release up to 5.2.8. The vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This can lead to partial compromise of confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity. No official patch or vendor advisory is provided in the input data. Users should check the vendor's resources for remediation updates.

CVE-2026-109692 is a Missing Authorization vulnerability in the ThemeGrill User Registration plugin affecting versions from initial through 5.2.8. The flaw allows exploitation due to incorrectly configured access control security levels. It has a CVSS 3.1 score of 7.1, indicating high severity with low attack complexity and requiring low privileges but no user interaction. The vulnerability impacts confidentiality and integrity but not availability.

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Retrieve Embedded Sensitive Data.This issue affects User Registration: from n/a through 5.2.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

Cross-Site Request Forgery (CSRF) vulnerability in ThemeGrill User Registration user-registration allows Cross Site Request Forgery.This issue affects User Registration: from n/a through 5.2.8.

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

CVE-2026-96334 is a missing authorization vulnerability in the ThemeGrill User Registration plugin affecting versions prior to 5.2.8. It allows unauthorized users to exploit incorrectly configured access control, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability has a medium severity with a CVSS score of 5.6.

CVE-2026-78290 is a cross-site scripting (XSS) vulnerability in ThemeGrill's Magazine Blocks plugin affecting versions up to and including 1.8.6. This vulnerability involves improper neutralization of input during web page generation, which can lead to reflected or stored XSS attacks. The CVSS score is 6.5, indicating a medium severity level. No specific affected versions beyond the upper bound of 1.8.6 are provided, and no patch or remediation information is available in the input data.

CVE-2026-66606 is a high-severity vulnerability in ThemeGrill SmartSMTP versions up to 1.2.0. It is an unauthenticated Cross-Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to data theft, session hijacking, or other impacts.

The Accelerate WordPress theme up to version 1.5.3 contains a missing authorization check vulnerability in the enqueue_scripts() function. This flaw allows authenticated users with Subscriber-level access or higher to install and activate the ThemeGrill Demo Importer plugin without proper permissions. The vulnerability is classified as CWE-862 (Missing Authorization).

The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, and zakra_menu_item_active_color) with 'show_in_rest' => true and 'auth_callback' => '__return_true', but without any sanitize_callback parameter in the register_post_meta() calls. While the classic editor save path applies sanitize_hex_color() sanitization, the REST API path completely bypasses this protection. The unsanitized meta values are then retrieved via get_post_meta() and concatenated directly into CSS strings that are output through wp_add_inline_style() without any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page.

Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 versions.

CVE-2026-49081 is a high-severity vulnerability in ThemeGrill's User Registration Stripe plugin versions up to and including 1.3.12. It involves missing authorization controls, allowing unauthenticated users to bypass access restrictions. This vulnerability is classified as CWE-862 (Missing Authorization).

Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

Unauthenticated Broken Authentication in Masteriyo - LMS <= 2.1.8 versions.

CVE-2026-39524 is a high-severity vulnerability in ThemeGrill's Masteriyo - LMS plugin versions up to and including 2.1.5. It involves unauthenticated broken access control, classified under CWE-862, allowing unauthorized users to perform actions that should require authorization. The vulnerability does not impact confidentiality but can lead to a high integrity impact without affecting availability.

Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.