CVE-2026-94169
CriticalCVSS 10.0Summary
The Grid plugin (the-grid) contains a Code Injection vulnerability due to improper control of code generation. The vulnerability allows an attacker to perform Command Injection.
Risk Assessment
Remote code execution may allow an attacker to take control of the server, steal data or further escalate within the network.
Recommendation
Update The Grid plugin to a version later than 2.8.1 that fixes the vulnerability, and restrict unauthorized code execution.
Other vulnerabilities in The Grid
See all- CVE-2026-28191High
Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. Affects versions from n/a through 2.8.0.
- CVE-2026-24370Medium
The Grid plugin for WordPress (up to version 2.8.0) contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-24369High
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. Affects versions from n/a through 2.8.0.
- CVE-2026-24368Medium
Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS