Themegoods develops a focused set of WordPress themes and plugins—including Grand Restaurant, Grand Conference, Photography, Altair, and Grand Tour—that serve as page-building and content-management tools for small-to-medium businesses and publishers. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and recur through web-application weakness classes including untrusted deserialization, cross-site scripting, missing authorization checks, cross-site request forgery, and path traversal, reflecting the access-control and input-handling demands of extensible plugin architectures. Defenders should treat updates to these widely installed themes and plugins as priority remediation targets; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Themegoods over time
Signals from CVEs in this vendor scope (24 CVEs).
24 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-23542CRITICAL Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Object Injection.This issue affects Grand Restaurant: from n/a through <= 7.0. | Feb 19, 2026 | 9.8 | 33 | NO | NO |
CVE-2025-68510HIGH Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeGoods Photography photography allows PHP Local File In | Jan 22, 2026 | 8.1 | 29 | NO | NO |
CVE-2025-47579HIGH Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2. | Sep 9, 2025 | 8.1 | 29 | NO | NO |
CVE-2025-32926CRITICAL Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Path Traversal.This issue affects | May 19, 2025 | 9.8 | 29 | NO | NO |
CVE-2024-12922CRITICAL The Altair theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check within functions.php in al | Mar 19, 2025 | 9.8 | 28 | NO | NO |
CVE-2025-60116HIGH Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Securi | Sep 26, 2025 | 8.8 | 27 | NO | NO |
CVE-2025-39485CRITICAL Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6. | May 23, 2025 | 9.8 | 26 | NO | NO |
CVE-2025-32928CRITICAL Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a through <= 5.2.2. | May 19, 2025 | 9.8 | 26 | NO | NO |
CVE-2026-65487MEDIUM Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. | Jul 23, 2026 | 5.3 | 25 | NO | NO |
CVE-2025-39354CRITICAL Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Conference grandconference allows Object Injection.This issue affects Grand Conference: from n/a through <= 5.3. | May 19, 2025 | 9.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (24 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Themegoods.
Media articles that mention a CVE ID that affects a product developed by Themegoods — matched by CVE ID, not by vendor name.