PatchTheCVEthemegoods vulnerabilities
Recent CVEs affecting themegoods products. 14 tracked.
themegoods has 14 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-01-08. Highest priority: CVE-2025-39485 (score 52/100).
- CVE-2025-60116 MEDIUM 5.4 UPGRADE Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-cust
- CVE-2025-67922 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoo
- CVE-2025-64224 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoo
- CVE-2025-64217 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoo
- CVE-2025-47584 HIGH 8.5 UPGRADE Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from
- CVE-2025-47579 CRITICAL 9.0 UPGRADE Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.
- CVE-2025-39485 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.Thi
- CVE-2025-39354 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object I
- CVE-2025-39353 MEDIUM 5.3 UPGRADE Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrect
- CVE-2025-39352 HIGH 8.2 UPGRADE Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrect
- CVE-2025-39351 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Cross Si
- CVE-2025-39348 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object I
- CVE-2025-32928 CRITICAL 9.8 UPGRADE Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue
- CVE-2025-32926 CRITICAL 9.8 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Gra
FAQ
How do I fix themegoods vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is themegoods being exploited right now?
None of the tracked themegoods CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which themegoods CVE should I patch first?
CVE-2025-39485 currently ranks highest (52/100): Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.Thi.