CVE-2026-28191
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. Affects versions from n/a through 2.8.0.
Risk Assessment
An attacker could exploit this to gain higher privileges, potentially leading to unauthorized access to administrative functions and compromise of the site.
Recommendation
Update The Grid theme to a version newer than 2.8.0 if a patch is available, or apply other mitigations.
Other vulnerabilities in The Grid
See all- CVE-2026-94169Critical
The Grid plugin (the-grid) contains a Code Injection vulnerability due to improper control of code generation. The vulnerability allows an attacker to perform Command Injection.
- CVE-2026-24370Medium
The Grid plugin for WordPress (up to version 2.8.0) contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-24369High
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. Affects versions from n/a through 2.8.0.
- CVE-2026-24368Medium
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS