boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-28191

CVE-2026-28191HIGH
ThemeOne The Grid — WordPress The Grid plugin <= 2.8.0 - Privilege Escalation vulnerability
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   L   N  U  H  H  H    8.8   .0042   33.8     —
AFFECTED
  Product   Versions  Fixed
  The Grid  n/a –     2.8.1
TIMELINE
  Feb 25  Reserved by Patchstack
  Aug 18  Published (CNA: Patchstack)
  Sep 1   PATCH SHIPPED — CVE-2026-28191 (ThemeOne The Grid). Fixed in The Grid 2.8.1.
CWE-266 · CNA: Patchstack · CVSS v3.1 · 1 reference · NVD status: Deferred

Description

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation. This issue affects The Grid: from n/a through 2.8.0.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
February 25, 2026ReservedReserved by Patchstack
August 18, 2026PublishedPublished (CNA: Patchstack)
September 1, 2026PATCH SHIPPEDPATCH SHIPPED — CVE-2026-28191 (ThemeOne The Grid). Fixed in The Grid 2.8.1.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
ThemeOneThe Grid—n/a2.8.1

Weaknesses

CWE-266

References (1)

Related

Authoritative record: CVE-2026-28191 at cve.org

Vendors: themeone

Weaknesses: CWE-266

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-28191 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.