Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.
Local file inclusion in AncoraThemes HealthHub WordPress theme up to version 1.3.0 permits unauthenticated attackers to read arbitrary local files via improper file path handling, potentially enabling remote code execution if a suitable upload or log chain exists. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low (0.08%). The vulnerability carries a CVSS 8.1 base score due to its unauthenticated network vector and high impact, though high attack complexity significantly limits practical exploitation.
Local file inclusion in the Otaku WordPress theme up to version 1.8.0 allows unauthenticated attackers to include arbitrary local PHP files, resulting in information disclosure, credential theft, or remote code execution. Exploitation requires high complexity and no public exploit or active attacks are currently confirmed. The vulnerability affects the AncoraThemes Otaku theme and is tracked as CVE-2025-58896.
Unauthenticated local file inclusion in AncoraThemes Integro WordPress theme ≤1.8.0 allows remote attackers to read arbitrary files on the server or potentially execute code. The vulnerability carries a CVSS 8.1 score but has low exploitation probability (EPSS 0.08%) and no evidence of active exploitation or public exploit code at the time of analysis.
Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.
Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).
Local file inclusion in the Tourimo WordPress theme (<=1.2.3) enables unauthenticated remote attackers to read arbitrary files and potentially execute arbitrary PHP code, leading to full site compromise. This vulnerability, reported by Patchstack, carries a CVSS score of 8.1 but has a low EPSS exploitation probability (0.08%), with no evidence of active exploitation or public exploit code.
Local file inclusion in the AncoraThemes Sanger WordPress theme up to version 1.24.0 allows unauthenticated remote attackers to include arbitrary local files, potentially disclosing sensitive data or executing arbitrary code under specific server conditions. No evidence of active exploitation exists, and the EPSS score of 0.08% indicates low likelihood of widespread attacks.
Local file inclusion vulnerability in the AncoraThemes Playful theme for WordPress up to version 1.19.0 allows unauthenticated attackers
Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.
Local file inclusion in AncoraThemes The Flash theme through version 1.15 enables unauthenticated attackers to read arbitrary files on the server, potentially exposing configuration files and leading to code execution. No public exploit has been identified, and EPSS probability is low (0.08%). The vulnerability is not listed in CISA KEV.
Local file inclusion in AncoraThemes Pathfinder WordPress theme through version 1.16 allows unauthenticated remote attackers to include arbitrary PHP files on the server, potentially leading to complete system compromise via code execution, though high attack complexity and very low exploitation probability (EPSS 0.08%) suggest limited real-world risk without specific server conditions.
Local file inclusion in AncoraThemes Festy theme for WordPress up to 1.13.0 allows unauthenticated remote attackers to read arbitrary files on the server. No known active exploitation, and EPSS indicates low probability (0.08%). Successful exploitation can expose sensitive configuration files but high attack complexity and no public exploit suggest lower immediate risk.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
Local file inclusion in the Hanani WordPress theme (versions up to 1.2.11) allows unauthenticated remote attackers to include arbitrary local files, potentially enabling full server compromise. Exploitation complexity is high, and EPSS indicates very low real-world exploitation probability. No active exploitation or public proof-of-concept is known at this time.
Unauthenticated local file inclusion in the Jack Well WordPress theme (<=1.0.14) allows remote attackers to read arbitrary files or execute PHP code on the server via manipulated file paths. The vulnerability carries a CVSS 8.1 score but a low EPSS exploitation probability (0.08%); no active exploitation or public exploit is known at this time.
Local file inclusion in the AncoraThemes Ludos Paradise WordPress theme up to version 2.1.3 permits unauthenticated remote attackers to include arbitrary local files, exposing sensitive server data such as configuration files or credentials. The vulnerability is not known to be actively exploited, and no public exploit code is available. Despite a high CVSS rating, the low EPSS probability and high attack complexity suggest a limited real-world risk.
Local file inclusion in the Kings & Queens WordPress theme by AncoraThemes (through version 1.1.16) enables unauthenticated attackers
Unauthenticated local file inclusion in the Gracioza WordPress theme versions up to 1.0.15 lets remote attackers read arbitrary files and potentially execute code. The flaw stems from improper sanitization of filenames used in include statements (CWE-98). No known public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Mamita WordPress theme (AncoraThemes, versions ≤ 1.0.9) exposes sites to unauthenticated path-traversal attacks where unsanitized input is passed directly to a PHP include() or require() call, enabling inclusion of arbitrary server-local files. Under the right server conditions, this can expose sensitive configuration files such as wp-config.php and escalate to remote code execution through techniques like log poisoning; the CVSS scorer's C:H/I:H/A:H ratings reflect this full-chain potential. No public exploit code has been identified and EPSS probability is 0.08% (23rd percentile), indicating low opportunistic exploitation risk at this time.
Local file inclusion in Militarology WordPress theme versions up to 1.0.15 allows unauthenticated remote attackers to include arbitrary local files, potentially exposing sensitive data and achieving remote code execution. The vulnerability carries a CVSS 3.1 score of 8.1 (high) but EPSS exploitation probability is low (0.08%), with no public exploit or active exploitation reported.
Local file inclusion in AncoraThemes ShieldGroup WordPress theme versions up to 2.13 enables unauthenticated remote attackers to include arbitrary local files. Despite high CVSS severity, EPSS indicates very low real-world exploitation probability; no active exploitation or public exploit code has been identified at time of analysis.
Local file inclusion in Riode WordPress theme versions ≤1.6.23 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem, potentially exposing configuration files, credentials, and source code. The vulnerability stems from improper filename control in PHP include/require statements. Despite the high CVSS score of 8.1, EPSS indicates only 0.06% exploitation probability (18th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Arbitrary file deletion in the Filr WordPress plugin (<=1.2.10) allows authenticated attackers to delete critical site files, causing a denial of service. No active exploitation or public exploit code has been reported, and EPSS indicates a low probability of widespread exploitation.
Unauthenticated attackers can modify IDonatePro WordPress plugin data (integrity impact high) due to missing authorization checks in versions up to 2.1.9. Exploitation requires no privileges or user interaction and is carried out over the network. At the time of analysis, no active exploitation, public exploit code, or CISA KEV listing exists; EPSS score is low (0.07%).
PHP object injection in PDF for Gravity Forms + Drag And Drop Template Builder (WordPress plugin) versions up to 6.5.0 allows authenticated attackers with low privileges to execute arbitrary code or manipulate application logic via unsafe deserialization. CVSS 7.5 (High) but EPSS probability of 0.07% (22nd percentile) indicates low observed exploitation likelihood. No public exploit identified at time of analysis, and attack requires high complexity (AC:H) with authenticated access (PR:L).
Local file inclusion in Ray Enterprise Translation WordPress plugin through version 1.7.1 allows remote attackers to read arbitrary files on the server via path traversal in PHP include statements. Despite the moderate CVSS score of 7.5, the EPSS probability of 0.06% (20th percentile) indicates minimal observed exploitation activity in the wild. Patchstack has cataloged this vulnerability with proof-of-concept details, requiring attackers to overcome high complexity conditions and user interaction to achieve impact across confidentiality, integrity, and availability.
Local file inclusion in Task Manager WordPress plugin versions ≤3.0.2 enables authenticated attackers with low privileges to read arbitrary files from the web server through improper filename control in PHP include/require statements. Exploitation requires network access with high attack complexity. EPSS score of 0.06% (18th percentile) indicates low probability of mass exploitation. No active exploitation confirmed in CISA KEV at time of analysis, though Patchstack vulnerability database documents this as a disclosed LFI vulnerability.
Arbitrary content deletion vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart plugin versions up to 24.6.0. Unauthenticated remote attackers can exploit missing authorization to delete arbitrary WordPress content, with no privileges or user interaction required. At time of analysis, no public exploit or active exploitation is known (EPSS 0.06%), though the issue has been disclosed by Patchstack.
Unauthenticated content deletion in MasterStudy LMS Pro WordPress plugin allows remote attackers to delete arbitrary learning content, causing complete availability loss. The vulnerability (CVE-2025-64214) affects versions up to 4.7.16, requires no authentication or user interaction
Missing authorization in the WP Voting Contest WordPress plugin (versions ≤5.8) allows unauthenticated attackers to manipulate voting data without any prior authentication. The vulnerability carries a CVSS 7.5 but has a low EPSS score (0.06%), indicating limited observed exploitation activity as of analysis.
Unauthenticated arbitrary content deletion in the Javo Core WordPress plugin up to version 3.0.0.529 can allow attackers to delete site content, causing a complete loss of data availability. The missing authorization vulnerability carries a CVSS 3.1 score of 7.5 with low EPSS exploitation probability, and no active exploitation or public proof-of-concept has been identified at the time of analysis.
Hard-coded credentials in Utarit Informatics SoliClub Android application versions prior to 5.3.7 allow remote unauthenticated attackers to abuse authentication and access confidential data. The flaw is tracked under CWE-798 with a CVSS 7.5 (high) confidentiality-only impact, and currently shows no public exploit identified at time of analysis with a low EPSS score of 0.06% (18th percentile).
Unauthenticated access to sensitive data in Ays Pro Easy Form plugin for WordPress up to version 2.7.8 allows remote attackers to obtain information due to a missing authorization check. This vulnerability has a CVSS 7.5 base score, but EPSS indicates low exploitation probability (0.05%). No active exploitation (CISA KEV) or public exploit code exists at time of analysis.
Unauthenticated information disclosure in PropertyHive plugin (≤2.1.12) allows remote attackers to access sensitive property data without authentication. The vulnerability stems from missing authorization checks on certain endpoints, effectively bypassing access controls. No active exploitation or public exploit code has been identified; EPSS score is very low.
Missing authorization in wpForo Forum up to version 2.4.10 allows remote unauthenticated attackers to access restricted forum content due to incorrectly configured access control security levels. The vulnerability is in the WordPress plugin and does not require user interaction; it results in high confidentiality impact with no integrity or availability effects. No active exploitation or public exploit code is known, and EPSS score of 0.05% indicates low exploitation likelihood.
Unauthenticated information disclosure in LearnPress for WordPress up to version 4.2.9.4 enables remote attackers to read sensitive data by bypassing missing authorization checks. Exploitation requires no credentials or user interaction, but no public exploit or active exploitation has been identified. EPSS score of 0.05% indicates very low probability of real-world attacks.