Wordpress Theme
Monthly
Stored or reflected Cross-Site Scripting in the Graphene WordPress theme (by silverks) version 2.9.4 and earlier allows a low-privileged Subscriber-level user to inject malicious JavaScript that executes in the browser of any higher-privileged user who views the affected content. The scope change (S:C) in the CVSS vector confirms impact extends beyond the attacker's own session to other users, enabling session hijacking, credential theft, or privilege escalation against site administrators. No public exploit code or active exploitation has been identified at time of analysis, but Patchstack has reported and documented the issue.
Reflected cross-site scripting in the Kriesi Enfold WordPress theme through version 8.0 allows unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of victims who click a crafted URL. The S:C scope change in the CVSS vector confirms the script executes in the victim's browser context, enabling session theft, credential harvesting, or forced actions under the victim's identity. No public exploit or active exploitation confirmed at time of analysis; reported by Patchstack.
Cross-Site Request Forgery in ThemeGoods Grand Tour WordPress theme (versions through 5.5.1) allows unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated administrators or editors by tricking them into visiting a crafted page. The flaw stems from missing or insufficient nonce validation on one or more theme-level AJAX or form-handling endpoints. No public exploit code or active exploitation has been confirmed; this is a Patchstack disclosure with CVSS 5.4 (Medium).
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) allows remote unauthenticated attackers to gain full control of affected sites. The compromised theme distributions ship with implanted malicious software, giving attackers a hidden channel for code execution and complete confidentiality, integrity, and availability compromise (CVSS 10.0). Reported by Patchstack; no public exploit identified at time of analysis and no CISA KEV listing.
Cross-site scripting in Uncode WordPress theme versions 2.12.7 and below allows unauthenticated attackers to inject arbitrary JavaScript that executes in victims' browsers upon interaction. The CVSS scope change (S:C) indicates injected scripts run in a security context beyond the theme itself - typically the authenticated victim's browser session - enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.
PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA's KEV catalog, though the Patchstack disclosure confirms the flaw exists in the released theme.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Broken Access Control in the Homlisti WordPress real estate theme (versions ≤ 3.1.2) allows authenticated subscribers to perform unauthorized write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H, AC:L) confirms low-privileged network-accessible exploitation with high integrity impact and no complexity barrier once a subscriber account is held. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Broken access control in the Altair WordPress theme (ThemeGoods) through version 5.2.2 permits unauthenticated remote attackers to invoke restricted functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any internet-reachable WordPress installation running the affected theme is exposed. Impact is bounded to partial integrity and availability degradation (C:N/I:L/A:L); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in the ThemeGoods Capella WordPress theme (versions up to and including 2.5.5) allows unauthenticated remote attackers to gain elevated privileges within a WordPress site, per a CVSS 3.1 base score of 9.8. Because the flaw requires no authentication and no user interaction, an attacker can leverage it directly over the network to compromise site integrity, confidentiality, and availability. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS and unauthenticated nature make it a high-priority patching target.
Unauthenticated SQL injection in the ThemeGoods 'Capella' WordPress theme (versions 2.5.5 and earlier) lets remote attackers inject arbitrary SQL through an unsanitized parameter, exposing backend database contents including the wp_users table. Reported by Patchstack and rated CVSS 9.3 with a scope change, the flaw needs no authentication or user interaction; no public exploit code and no active exploitation have been reported at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.
Unauthenticated broken access control in the Gillion WordPress theme (versions ≤ 4.13) allows remote attackers to modify certain data without authentication, with no confidentiality or availability impact. The vulnerability, tracked as CVE-2026-66477, has a CVSS score of 5.3 (Low integrity). No known public exploit or active exploitation exists at this time.
Broken access control in the Photography WordPress theme by ThemeGoods (versions ≤ 7.7.6) permits remote unauthenticated attackers to perform unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms trivial network exploitability with low complexity, rooted in CWE-862 (Missing Authorization), where theme logic fails to enforce capability checks before processing sensitive requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
Broken access control in the Civi WordPress theme (by uxper) versions up to and including 2.2.4 permits unauthenticated remote attackers to perform restricted actions that should require authorization. The vulnerability stems from missing authorization checks (CWE-862), allowing network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to abuse against any unpatched installation.
Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Select-Themes "Struktur" WordPress theme (all versions up to and including 2.5.1) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive content such as wp-config.php credentials and, under the right conditions, escalating to code execution. Tracked as CVE-2026-57802 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS vector's PR:L indicates authentication is required and AC:H reflects non-trivial exploitation preconditions.
PHP Local File Inclusion in the Select-Themes SetSail WordPress theme (versions up to and including 2.1) allows an authenticated attacker to coerce the application into including local files via improper control of a filename in an include/require statement. Successful exploitation can disclose sensitive files (e.g., wp-config.php) and, depending on server conditions, escalate to code execution through log poisoning or PHP wrapper abuse. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.
Local File Inclusion in the Edge-Themes 'Overworld' WordPress theme (versions up to and including 1.5) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary server-side files, disclosing sensitive data such as wp-config.php credentials and potentially escalating to code execution via log/session poisoning. The flaw was reported by Patchstack and is classified as CWE-98 (PHP Remote File Inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local file inclusion in the uxper Nuss WordPress theme (versions up to and including 1.3.6) lets an authenticated attacker with low-privilege access coerce the theme into including arbitrary PHP-parsable files from the server via improperly controlled include/require paths (CWE-98). Successful exploitation can disclose sensitive files and, depending on what can be included, lead to code execution, with high confidentiality, integrity, and availability impact per the CVSS 7.5 rating. No public exploit identified at time of analysis; the flaw was reported through Patchstack.
Broken access control in ThemeMove's EduMall WordPress theme (versions through 4.5.1) permits authenticated low-privileged users to invoke restricted functionality without proper authorization checks. An attacker with any valid WordPress account can bypass the intended access control tiers and trigger actions that degrade site availability. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a contained, low-severity impact limited to availability.
Local File Inclusion in the VLThemes Leedo WordPress theme (versions up to and including 3.0.0) allows authenticated attackers to include and execute arbitrary local files on the server via improper control of a filename passed to a PHP include/require statement. Although classified under PHP Remote File Inclusion (CWE-98), Patchstack characterizes the practical impact as Local File Inclusion, enabling disclosure of sensitive files and potential code execution from locally accessible content. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Local File Inclusion in the Kitchor WordPress theme by themelexus (versions up to and including 1.4.3) allows an authenticated attacker to coerce a PHP include/require statement into loading arbitrary local files from the server. Because the theme fails to constrain the filename passed to an include path (CWE-98), an attacker with at least low-level authenticated access can read sensitive files such as wp-config.php and, under the right conditions, escalate to PHP code execution via log poisoning or inclusion of attacker-influenced content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.5.
Local File Inclusion in the Elated-Themes 'Flow' WordPress theme (all versions up to and including 1.8) lets an authenticated attacker abuse an improperly controlled include/require path to read local files and potentially execute PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but low-privilege, high-complexity flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes from Patchstack.
Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met.
Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the jwsthemes Aqua WordPress theme (versions up to and including 5.1.2) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive data and potentially achieving code execution. Reported by Patchstack under CWE-98, the flaw carries CVSS 7.5 but requires low-level privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.
Local File Inclusion in the Edge-Themes "Aalto" WordPress theme (all versions up to and including 1.8) lets an authenticated attacker control a filename passed to a PHP include/require statement, exposing local files and potentially executing PHP. The flaw was reported by Patchstack and carries CVSS 7.5; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Despite the CWE-98 "Remote File Inclusion" classification, the described impact is Local File Inclusion.
Unauthenticated broken access control in the Fascinate WordPress theme by themebeez (versions through 1.1.5) permits remote attackers to exploit incorrectly configured capability checks, resulting in unauthorized write-level actions on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, with impact limited to integrity (I:L). No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Broken access control in the VW Wedding WordPress theme (vowelweb) allows unauthenticated remote attackers to exploit incorrectly configured authorization checks, resulting in limited availability impact against affected WordPress installations. All versions through 1.3.7 are affected per the CPE string cpe:2.3:a:vowelweb:vw_wedding. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, placing this in the lower-urgency tier despite network-level reachability.
Missing authorization controls in the VW Food Corner WordPress theme (versions through 1.1.0) permit unauthenticated remote attackers to invoke restricted theme functionality without valid access credentials, resulting in availability impact. Reported by Patchstack and classified under CWE-862, the flaw stems from incorrectly configured access control levels that fail to verify caller identity or capability before executing protected actions. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
PHP Object Injection in the ThemeGoods Grand Photography WordPress theme (all versions up to and including 5.7.8) lets remote attackers deliver crafted serialized data to an unsafe unserialize() sink, potentially achieving code execution, file operations, or SQL injection through POP gadget chains. The CVSS 9.8 rating reflects unauthenticated network exploitation (PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Broken access control in the UX-Themes Flatsome WordPress theme (versions up to and including 3.20.5) allows remote unauthenticated attackers to reach functionality or data that should be authorization-gated, resulting in confidentiality-only impact per the CVSS vector. The flaw stems from a missing authorization check (CWE-862) and was catalogued by Patchstack, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Flatsome is one of the most widely sold commercial WooCommerce themes, so the affected footprint is substantial even though only information disclosure (not integrity or availability) is implicated.
Reflected cross-site scripting in the UX-themes Flatsome WordPress/WooCommerce theme (all versions up to and including 3.20.5) lets a remote attacker inject script that executes in a victim's browser when they click a crafted link. Reported by Patchstack with a CVSS 3.1 score of 7.1 (scope-changed, low-impact), the flaw requires user interaction but no authentication. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the ThemeHunk Open Shop WordPress theme (versions up to and including 1.7.1) lets an authenticated low-privileged user reach functionality that should be restricted, tampering with data and degrading site availability. Reported by Patchstack and rated CVSS 7.1, the flaw stems from missing authorization checks on a privileged action. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the NooTheme Jobmonster WordPress job-board theme (versions up to and including 4.8.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the flaw carries a scope change (S:C), successful exploitation can affect resources beyond the vulnerable component, such as the authenticated WordPress session of an administrator who is lured into clicking. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting via cross-site request forgery affects the SEOWP WordPress theme by BlueAstralThemes in all versions up to and including 3.12.2, allowing a remote unauthenticated attacker who tricks a logged-in administrator into loading a malicious page to forge a state-changing request that injects persistent script into the site. The CVSS 3.1 score of 7.1 reflects a scope change (attacker-controlled JavaScript executes in the victim's browser session) with limited confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation hinges on successful social engineering of an authenticated victim (UI:R).
Broken access control in the Flatsome WordPress theme (versions <= 3.20.5) allows contributor-level authenticated users to access sensitive data they are not authorized to view. The flaw stems from missing authorization checks (CWE-862), enabling privilege escalation beyond the contributor role's intended scope - specifically a high confidentiality impact with no integrity or availability consequence per the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and network-accessible attack vector lower the bar for abuse by any site user holding a contributor account.
Broken access control in Flatsome WordPress theme versions 3.20.5 and earlier allows authenticated subscriber-level users to access restricted resources or perform actions beyond their intended authorization. The flaw stems from missing authorization checks (CWE-862) on one or more endpoints or actions within the theme, enabling low-privilege WordPress users to retrieve information they should not be permitted to view. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is limited to authenticated users, reducing opportunistic risk.
Cross-Site Request Forgery in the Werkstatt WordPress theme (FuelThemes) version 4.7.2 and earlier allows remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated WordPress users. The flaw stems from missing or inadequate CSRF token validation on one or more theme action endpoints, meaning a crafted web page or link can silently trigger privileged operations when visited by a logged-in user. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken access control in the Werkstatt WordPress theme (Fuelthemes) versions 4.7.2 and below allows subscriber-level authenticated users to access functionality or data restricted to higher-privileged roles. The root cause is missing authorization checks (CWE-862), permitting low-privilege WordPress accounts to bypass intended access restrictions and read protected information. No public exploit code is identified and the vulnerability is not listed in CISA KEV, but the low-complexity network vector makes it trivially exploitable by any subscriber-level user on affected sites.
TheFox WordPress theme by tranmautritam in versions 3.9.70 and earlier allows a Contributor-level authenticated attacker to inject persistent Cross-Site Scripting payloads into theme-specific input fields, which then execute in the browsers of any user who views the affected content. The Changed Scope (S:C) in the CVSS vector confirms the payload crosses security boundaries into the victim browser context, enabling session token theft, credential harvesting, or unauthorized administrative actions against higher-privileged users such as editors or site admins. No public proof-of-concept and no CISA KEV listing have been identified at time of analysis; the vulnerability was reported and documented by Patchstack.
Reflected/stored Cross-Site Scripting in the Real Estate 7 WordPress theme (contempoinc) versions 3.5.9 and earlier lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link or page. The scope-changing flaw (CVSS 3.1 7.1) can hijack sessions or perform actions in the victim's authenticated context, including administrators. Reported by Patchstack; no public exploit code has been identified and it is not on the CISA KEV list.
Unauthenticated Local File Inclusion in the Audrey WordPress theme (elated-themes) affects all versions up to and including 1.5, letting remote attackers coerce the PHP application into including arbitrary files. Because CWE-98 covers PHP file-inclusion flaws, a successful include can leak sensitive files (wp-config.php, credentials) and, where remote or attacker-controlled content is includable, escalate to code execution. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, though the network-reachable, unauthenticated nature (CVSS 8.1) makes it a meaningful patching priority for sites running this theme.
Broken access control in the Motors WordPress theme (by StyleMixThemes) versions 5.6.80 and earlier allows unauthenticated remote attackers to perform unauthorized actions, resulting in limited integrity and availability impact without requiring any credentials or user interaction. The vulnerability stems from CWE-862 (Missing Authorization), where specific theme functionality fails to enforce permission checks before executing sensitive operations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack profile makes opportunistic exploitation straightforward for any threat actor targeting WordPress installations.
Reflected cross-site scripting in the TheFox WordPress theme (versions 3.9.76 and earlier) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Reported through Patchstack and scoped to the ThemeForest 'tranmautritam:thefox' theme, the flaw carries a CVSS 3.1 base score of 7.1 driven largely by a changed scope. There is no public exploit identified at time of analysis and no CISA KEV listing, so risk hinges on tricking a user into clicking a malicious URL.
Reflected cross-site scripting in the Automotive Car Dealership Business WordPress theme (versions 13.3.3 and earlier by ThemeSuite) lets unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) confirms network-based, unauthenticated exploitation that requires user interaction and crosses a security scope boundary. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV.
Arbitrary file upload in the Zegen WordPress theme (versions 1.1.9 and earlier) lets a low-privileged authenticated user (Subscriber role) upload files without adequate type validation, enabling upload of executable PHP and full site compromise. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a minimally-privileged account can escalate to server-level code execution. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Werkstatt WordPress theme (fuelthemes) through version 4.8.3 lets a Contributor-level user pass attacker-controlled data into an unsafe deserialization routine, enabling instantiation of arbitrary PHP objects. With the right POP gadget chain present in WordPress core, another plugin, or the theme itself, this can escalate to file operations, SQL manipulation, or remote code execution. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the 8.8 CVSS reflects the low-privilege network-exploitable path with high confidentiality, integrity, and availability impact.
Local File Inclusion in the Pearl - Corporate Business WordPress theme (StyleMixThemes) versions 3.4.10 and earlier lets unauthenticated remote attackers coerce the application into including arbitrary local files, exposing sensitive server-side content such as configuration files and credentials. Rated CVSS 8.1 by Patchstack, the flaw requires no authentication (PR:N) but carries high attack complexity (AC:H), and depending on include handling could escalate from information disclosure toward code execution. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Reflected cross-site scripting in the NativeChurch WordPress theme (versions 4.8.8.2 and earlier, by imithemes) allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (7.1) reflects a scope change with limited confidentiality, integrity, and availability impact, and requires victim interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed through Patchstack's WordPress vulnerability database.
Reflected Cross-Site Scripting in the designthemes LMS WordPress theme (versions 9.7 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they open a crafted link. Reported by Patchstack, the flaw carries CVSS 7.1 with a scope change, reflecting cross-context impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Trendy Travel WordPress theme (versions 6.7 and earlier) by designthemes lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Rated CVSS 7.1 with a scope change (S:C), reflecting that injected script can act across the WordPress security boundary. No public exploit identified at time of analysis, and no EPSS score was supplied.
Stored or reflected Cross-Site Scripting in the Graphene WordPress theme (by silverks) version 2.9.4 and earlier allows a low-privileged Subscriber-level user to inject malicious JavaScript that executes in the browser of any higher-privileged user who views the affected content. The scope change (S:C) in the CVSS vector confirms impact extends beyond the attacker's own session to other users, enabling session hijacking, credential theft, or privilege escalation against site administrators. No public exploit code or active exploitation has been identified at time of analysis, but Patchstack has reported and documented the issue.
Reflected cross-site scripting in the Kriesi Enfold WordPress theme through version 8.0 allows unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of victims who click a crafted URL. The S:C scope change in the CVSS vector confirms the script executes in the victim's browser context, enabling session theft, credential harvesting, or forced actions under the victim's identity. No public exploit or active exploitation confirmed at time of analysis; reported by Patchstack.
Cross-Site Request Forgery in ThemeGoods Grand Tour WordPress theme (versions through 5.5.1) allows unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated administrators or editors by tricking them into visiting a crafted page. The flaw stems from missing or insufficient nonce validation on one or more theme-level AJAX or form-handling endpoints. No public exploit code or active exploitation has been confirmed; this is a Patchstack disclosure with CVSS 5.4 (Medium).
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) allows remote unauthenticated attackers to gain full control of affected sites. The compromised theme distributions ship with implanted malicious software, giving attackers a hidden channel for code execution and complete confidentiality, integrity, and availability compromise (CVSS 10.0). Reported by Patchstack; no public exploit identified at time of analysis and no CISA KEV listing.
Cross-site scripting in Uncode WordPress theme versions 2.12.7 and below allows unauthenticated attackers to inject arbitrary JavaScript that executes in victims' browsers upon interaction. The CVSS scope change (S:C) indicates injected scripts run in a security context beyond the theme itself - typically the authenticated victim's browser session - enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.
PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA's KEV catalog, though the Patchstack disclosure confirms the flaw exists in the released theme.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Broken Access Control in the Homlisti WordPress real estate theme (versions ≤ 3.1.2) allows authenticated subscribers to perform unauthorized write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H, AC:L) confirms low-privileged network-accessible exploitation with high integrity impact and no complexity barrier once a subscriber account is held. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Broken access control in the Altair WordPress theme (ThemeGoods) through version 5.2.2 permits unauthenticated remote attackers to invoke restricted functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any internet-reachable WordPress installation running the affected theme is exposed. Impact is bounded to partial integrity and availability degradation (C:N/I:L/A:L); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Privilege escalation in the ThemeGoods Capella WordPress theme (versions up to and including 2.5.5) allows unauthenticated remote attackers to gain elevated privileges within a WordPress site, per a CVSS 3.1 base score of 9.8. Because the flaw requires no authentication and no user interaction, an attacker can leverage it directly over the network to compromise site integrity, confidentiality, and availability. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS and unauthenticated nature make it a high-priority patching target.
Unauthenticated SQL injection in the ThemeGoods 'Capella' WordPress theme (versions 2.5.5 and earlier) lets remote attackers inject arbitrary SQL through an unsanitized parameter, exposing backend database contents including the wp_users table. Reported by Patchstack and rated CVSS 9.3 with a scope change, the flaw needs no authentication or user interaction; no public exploit code and no active exploitation have been reported at time of analysis.
Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.
Unauthenticated broken access control in the Gillion WordPress theme (versions ≤ 4.13) allows remote attackers to modify certain data without authentication, with no confidentiality or availability impact. The vulnerability, tracked as CVE-2026-66477, has a CVSS score of 5.3 (Low integrity). No known public exploit or active exploitation exists at this time.
Broken access control in the Photography WordPress theme by ThemeGoods (versions ≤ 7.7.6) permits remote unauthenticated attackers to perform unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms trivial network exploitability with low complexity, rooted in CWE-862 (Missing Authorization), where theme logic fails to enforce capability checks before processing sensitive requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.
Broken access control in the Civi WordPress theme (by uxper) versions up to and including 2.2.4 permits unauthenticated remote attackers to perform restricted actions that should require authorization. The vulnerability stems from missing authorization checks (CWE-862), allowing network-accessible exploitation with no credentials or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to abuse against any unpatched installation.
Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Select-Themes "Struktur" WordPress theme (all versions up to and including 2.5.1) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive content such as wp-config.php credentials and, under the right conditions, escalating to code execution. Tracked as CVE-2026-57802 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS vector's PR:L indicates authentication is required and AC:H reflects non-trivial exploitation preconditions.
PHP Local File Inclusion in the Select-Themes SetSail WordPress theme (versions up to and including 2.1) allows an authenticated attacker to coerce the application into including local files via improper control of a filename in an include/require statement. Successful exploitation can disclose sensitive files (e.g., wp-config.php) and, depending on server conditions, escalate to code execution through log poisoning or PHP wrapper abuse. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.
Local File Inclusion in the Edge-Themes 'Overworld' WordPress theme (versions up to and including 1.5) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary server-side files, disclosing sensitive data such as wp-config.php credentials and potentially escalating to code execution via log/session poisoning. The flaw was reported by Patchstack and is classified as CWE-98 (PHP Remote File Inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local file inclusion in the uxper Nuss WordPress theme (versions up to and including 1.3.6) lets an authenticated attacker with low-privilege access coerce the theme into including arbitrary PHP-parsable files from the server via improperly controlled include/require paths (CWE-98). Successful exploitation can disclose sensitive files and, depending on what can be included, lead to code execution, with high confidentiality, integrity, and availability impact per the CVSS 7.5 rating. No public exploit identified at time of analysis; the flaw was reported through Patchstack.
Broken access control in ThemeMove's EduMall WordPress theme (versions through 4.5.1) permits authenticated low-privileged users to invoke restricted functionality without proper authorization checks. An attacker with any valid WordPress account can bypass the intended access control tiers and trigger actions that degrade site availability. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 4.3 reflects a contained, low-severity impact limited to availability.
Local File Inclusion in the VLThemes Leedo WordPress theme (versions up to and including 3.0.0) allows authenticated attackers to include and execute arbitrary local files on the server via improper control of a filename passed to a PHP include/require statement. Although classified under PHP Remote File Inclusion (CWE-98), Patchstack characterizes the practical impact as Local File Inclusion, enabling disclosure of sensitive files and potential code execution from locally accessible content. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Local File Inclusion in the Kitchor WordPress theme by themelexus (versions up to and including 1.4.3) allows an authenticated attacker to coerce a PHP include/require statement into loading arbitrary local files from the server. Because the theme fails to constrain the filename passed to an include path (CWE-98), an attacker with at least low-level authenticated access can read sensitive files such as wp-config.php and, under the right conditions, escalate to PHP code execution via log poisoning or inclusion of attacker-influenced content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.5.
Local File Inclusion in the Elated-Themes 'Flow' WordPress theme (all versions up to and including 1.8) lets an authenticated attacker abuse an improperly controlled include/require path to read local files and potentially execute PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but low-privilege, high-complexity flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes from Patchstack.
Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met.
Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the jwsthemes Aqua WordPress theme (versions up to and including 5.1.2) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive data and potentially achieving code execution. Reported by Patchstack under CWE-98, the flaw carries CVSS 7.5 but requires low-level privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.
Local File Inclusion in the Edge-Themes "Aalto" WordPress theme (all versions up to and including 1.8) lets an authenticated attacker control a filename passed to a PHP include/require statement, exposing local files and potentially executing PHP. The flaw was reported by Patchstack and carries CVSS 7.5; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Despite the CWE-98 "Remote File Inclusion" classification, the described impact is Local File Inclusion.
Unauthenticated broken access control in the Fascinate WordPress theme by themebeez (versions through 1.1.5) permits remote attackers to exploit incorrectly configured capability checks, resulting in unauthorized write-level actions on affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required, with impact limited to integrity (I:L). No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Broken access control in the VW Wedding WordPress theme (vowelweb) allows unauthenticated remote attackers to exploit incorrectly configured authorization checks, resulting in limited availability impact against affected WordPress installations. All versions through 1.3.7 are affected per the CPE string cpe:2.3:a:vowelweb:vw_wedding. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, placing this in the lower-urgency tier despite network-level reachability.
Missing authorization controls in the VW Food Corner WordPress theme (versions through 1.1.0) permit unauthenticated remote attackers to invoke restricted theme functionality without valid access credentials, resulting in availability impact. Reported by Patchstack and classified under CWE-862, the flaw stems from incorrectly configured access control levels that fail to verify caller identity or capability before executing protected actions. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
PHP Object Injection in the ThemeGoods Grand Photography WordPress theme (all versions up to and including 5.7.8) lets remote attackers deliver crafted serialized data to an unsafe unserialize() sink, potentially achieving code execution, file operations, or SQL injection through POP gadget chains. The CVSS 9.8 rating reflects unauthenticated network exploitation (PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Broken access control in the UX-Themes Flatsome WordPress theme (versions up to and including 3.20.5) allows remote unauthenticated attackers to reach functionality or data that should be authorization-gated, resulting in confidentiality-only impact per the CVSS vector. The flaw stems from a missing authorization check (CWE-862) and was catalogued by Patchstack, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Flatsome is one of the most widely sold commercial WooCommerce themes, so the affected footprint is substantial even though only information disclosure (not integrity or availability) is implicated.
Reflected cross-site scripting in the UX-themes Flatsome WordPress/WooCommerce theme (all versions up to and including 3.20.5) lets a remote attacker inject script that executes in a victim's browser when they click a crafted link. Reported by Patchstack with a CVSS 3.1 score of 7.1 (scope-changed, low-impact), the flaw requires user interaction but no authentication. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the ThemeHunk Open Shop WordPress theme (versions up to and including 1.7.1) lets an authenticated low-privileged user reach functionality that should be restricted, tampering with data and degrading site availability. Reported by Patchstack and rated CVSS 7.1, the flaw stems from missing authorization checks on a privileged action. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the NooTheme Jobmonster WordPress job-board theme (versions up to and including 4.8.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the flaw carries a scope change (S:C), successful exploitation can affect resources beyond the vulnerable component, such as the authenticated WordPress session of an administrator who is lured into clicking. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting via cross-site request forgery affects the SEOWP WordPress theme by BlueAstralThemes in all versions up to and including 3.12.2, allowing a remote unauthenticated attacker who tricks a logged-in administrator into loading a malicious page to forge a state-changing request that injects persistent script into the site. The CVSS 3.1 score of 7.1 reflects a scope change (attacker-controlled JavaScript executes in the victim's browser session) with limited confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation hinges on successful social engineering of an authenticated victim (UI:R).
Broken access control in the Flatsome WordPress theme (versions <= 3.20.5) allows contributor-level authenticated users to access sensitive data they are not authorized to view. The flaw stems from missing authorization checks (CWE-862), enabling privilege escalation beyond the contributor role's intended scope - specifically a high confidentiality impact with no integrity or availability consequence per the CVSS vector. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and network-accessible attack vector lower the bar for abuse by any site user holding a contributor account.
Broken access control in Flatsome WordPress theme versions 3.20.5 and earlier allows authenticated subscriber-level users to access restricted resources or perform actions beyond their intended authorization. The flaw stems from missing authorization checks (CWE-862) on one or more endpoints or actions within the theme, enabling low-privilege WordPress users to retrieve information they should not be permitted to view. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is limited to authenticated users, reducing opportunistic risk.
Cross-Site Request Forgery in the Werkstatt WordPress theme (FuelThemes) version 4.7.2 and earlier allows remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated WordPress users. The flaw stems from missing or inadequate CSRF token validation on one or more theme action endpoints, meaning a crafted web page or link can silently trigger privileged operations when visited by a logged-in user. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Broken access control in the Werkstatt WordPress theme (Fuelthemes) versions 4.7.2 and below allows subscriber-level authenticated users to access functionality or data restricted to higher-privileged roles. The root cause is missing authorization checks (CWE-862), permitting low-privilege WordPress accounts to bypass intended access restrictions and read protected information. No public exploit code is identified and the vulnerability is not listed in CISA KEV, but the low-complexity network vector makes it trivially exploitable by any subscriber-level user on affected sites.
TheFox WordPress theme by tranmautritam in versions 3.9.70 and earlier allows a Contributor-level authenticated attacker to inject persistent Cross-Site Scripting payloads into theme-specific input fields, which then execute in the browsers of any user who views the affected content. The Changed Scope (S:C) in the CVSS vector confirms the payload crosses security boundaries into the victim browser context, enabling session token theft, credential harvesting, or unauthorized administrative actions against higher-privileged users such as editors or site admins. No public proof-of-concept and no CISA KEV listing have been identified at time of analysis; the vulnerability was reported and documented by Patchstack.
Reflected/stored Cross-Site Scripting in the Real Estate 7 WordPress theme (contempoinc) versions 3.5.9 and earlier lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link or page. The scope-changing flaw (CVSS 3.1 7.1) can hijack sessions or perform actions in the victim's authenticated context, including administrators. Reported by Patchstack; no public exploit code has been identified and it is not on the CISA KEV list.
Unauthenticated Local File Inclusion in the Audrey WordPress theme (elated-themes) affects all versions up to and including 1.5, letting remote attackers coerce the PHP application into including arbitrary files. Because CWE-98 covers PHP file-inclusion flaws, a successful include can leak sensitive files (wp-config.php, credentials) and, where remote or attacker-controlled content is includable, escalate to code execution. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, though the network-reachable, unauthenticated nature (CVSS 8.1) makes it a meaningful patching priority for sites running this theme.
Broken access control in the Motors WordPress theme (by StyleMixThemes) versions 5.6.80 and earlier allows unauthenticated remote attackers to perform unauthorized actions, resulting in limited integrity and availability impact without requiring any credentials or user interaction. The vulnerability stems from CWE-862 (Missing Authorization), where specific theme functionality fails to enforce permission checks before executing sensitive operations. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack profile makes opportunistic exploitation straightforward for any threat actor targeting WordPress installations.
Reflected cross-site scripting in the TheFox WordPress theme (versions 3.9.76 and earlier) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Reported through Patchstack and scoped to the ThemeForest 'tranmautritam:thefox' theme, the flaw carries a CVSS 3.1 base score of 7.1 driven largely by a changed scope. There is no public exploit identified at time of analysis and no CISA KEV listing, so risk hinges on tricking a user into clicking a malicious URL.
Reflected cross-site scripting in the Automotive Car Dealership Business WordPress theme (versions 13.3.3 and earlier by ThemeSuite) lets unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (AV:N/PR:N/UI:R/S:C) confirms network-based, unauthenticated exploitation that requires user interaction and crosses a security scope boundary. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV.
Arbitrary file upload in the Zegen WordPress theme (versions 1.1.9 and earlier) lets a low-privileged authenticated user (Subscriber role) upload files without adequate type validation, enabling upload of executable PHP and full site compromise. The CVSS 3.1 base score is 9.9 with a scope change, reflecting that a minimally-privileged account can escalate to server-level code execution. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Werkstatt WordPress theme (fuelthemes) through version 4.8.3 lets a Contributor-level user pass attacker-controlled data into an unsafe deserialization routine, enabling instantiation of arbitrary PHP objects. With the right POP gadget chain present in WordPress core, another plugin, or the theme itself, this can escalate to file operations, SQL manipulation, or remote code execution. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the 8.8 CVSS reflects the low-privilege network-exploitable path with high confidentiality, integrity, and availability impact.
Local File Inclusion in the Pearl - Corporate Business WordPress theme (StyleMixThemes) versions 3.4.10 and earlier lets unauthenticated remote attackers coerce the application into including arbitrary local files, exposing sensitive server-side content such as configuration files and credentials. Rated CVSS 8.1 by Patchstack, the flaw requires no authentication (PR:N) but carries high attack complexity (AC:H), and depending on include handling could escalate from information disclosure toward code execution. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.
Reflected cross-site scripting in the NativeChurch WordPress theme (versions 4.8.8.2 and earlier, by imithemes) allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 vector (7.1) reflects a scope change with limited confidentiality, integrity, and availability impact, and requires victim interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was disclosed through Patchstack's WordPress vulnerability database.
Reflected Cross-Site Scripting in the designthemes LMS WordPress theme (versions 9.7 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they open a crafted link. Reported by Patchstack, the flaw carries CVSS 7.1 with a scope change, reflecting cross-context impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Trendy Travel WordPress theme (versions 6.7 and earlier) by designthemes lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Rated CVSS 7.1 with a scope change (S:C), reflecting that injected script can act across the WordPress security boundary. No public exploit identified at time of analysis, and no EPSS score was supplied.