All vulnerabilities
CVE-2026-94169

WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

Theme-one The Grid
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationScanner template publicA Nuclei template detects it. Not in the KEV catalogNuclei
Exploit odds (EPSS)3.28%Chance of exploitation activity in the next 30 days, higher than 88% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published16 Oct 2026Updated 16 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Public exploit code and templates 1

  • Scanner templateThe Grid <= 2.8.1 - Unauthenticated Code InjectionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.

Text from CVE List

Affected versions 1

  • The Gridaffected: all versions through 2.8.1CVE List

References 1