What is the CVSS score of CVE-2026-94161?

CVE-2026-94161 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L.

Which versions of Grand Restaurant Theme are affected by CVE-2026-94161?

Hospitality and restaurant brands running the ThemeGoods Grand Restaurant WordPress theme on versions below 7.0.11 are exposed to a reflected cross-site scripting flaw that runs attacker-supplied…. A patch is available.

How to fix or mitigate CVE-2026-94161?

Within 24 hours, inventory every WordPress site running the ThemeGoods Grand Restaurant theme and determine which instances are below version 7.0.11; for any internet-facing instance that cannot be confirmed as remediated, deploy virtual patching through the WAF to block encoded script tags, event-handler attributes, and javascript: schemes in reflected query parameters, and consider temporarily restricting wp-admin access by IP. Within 7 days, move all affected sites to version 7.0.11 or later - the advisory's version boundary points to 7.0.11 as the remediated release, but patch availability is not confirmed at time of analysis, so verify the fix directly with ThemeGoods before relying on it - and where the release is unavailable, migrate to a supported theme or decommission the site; in parallel, reset credentials and invalidate sessions for administrators who may have clicked suspicious links, and review WordPress audit logs for unauthorized user creation, plugin installation, or content modification. Within 30 days, if 7.0.11 or an equivalent fix remains unobtainable, formally accept the residual risk only for sites with no authenticated users or sensitive data, retire the theme everywhere else, and add recurring theme-version and WAF alerting so the estate does not drift behind future releases.

Grand Restaurant Theme CVE-2026-94161

EUVD-2026-95632 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-10-09 Patchstack

GHSA-g3cg-v4xq-phhq

WordPress XSS Grand Restaurant Wordpress Theme Themegoods

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS is remotely deliverable (AV:N/AC:L/PR:N) but needs victim click (UI:R) and executes cross-context (S:C) with limited C/I; no genuine availability impact, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Oct 09, 2026 - 11:02 EUVD

Analysis Generated

Oct 09, 2026 - 11:00 vuln.today

CVE Published

Oct 09, 2026 - 10:00 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

AnalysisAI

Reflected cross-site scripting in the ThemeGoods Grand Restaurant WordPress theme (all versions before 7.0.11) lets an unauthenticated remote attacker craft a URL that, once a victim clicks it, executes attacker-supplied script in the context of the victim's WordPress site session. The vulnerability is rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, with scope change (S:C) reflecting that the injected code runs in the victim's browser rather than affecting only the vulnerable component, and exploitation depends on social engineering because user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an attacker to deliver a crafted URL to a victim who must then click it (UI:R / reflected XSS), so success depends on social engineering rather than a server-side configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate-severity Reflected XSS (CWE-79) in the ThemeGoods Grand Restaurant WordPress theme, rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: 7.0.11 - update the Grand Restaurant theme to version 7.0.11 or later, which is the exact fixed release referenced in the vendor advisory at https://patchstack.com/database/wordpress/theme/grandrestaurant/vulnerability/wordpress-grand-restaurant-theme-7-0-11-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every WordPress site running the ThemeGoods Grand Restaurant theme and determine which instances are below version 7.0.11; for any internet-facing instance that cannot be confirmed as remediated, deploy virtual patching through the WAF to block encoded script tags, event-handler attributes, and javascript: schemes in reflected query parameters, and consider temporarily restricting wp-admin access by IP. …

Threat intelligence, references, and detailed analysis are available after sign-in.