Wordpress Theme
Monthly
PHP object injection in the AivahThemes Hostme v2 WordPress theme (all versions through 7.0) allows unauthenticated remote attackers to pass serialized data into a PHP unserialize() sink, which can lead to arbitrary object instantiation and, where a usable gadget chain exists, code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any site running the theme with the affected code path active is exposed. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and no CISA KEV entry indicates confirmed active exploitation. The precise request parameter or endpoint that reaches the sink is not described in the available sources, and no fixed version is listed in the evidence.
DOM-based cross-site scripting in the AivahThemes Hostme v2 WordPress theme (versions through 7.0) allows remote attackers to execute script in a victim's browser session on an affected site. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): no attacker authentication is required, but exploitation depends on a targeted victim visiting or clicking attacker-supplied content that the theme's client-side JavaScript renders into the DOM without neutralization, and the scope change means injected code can act beyond the vulnerable component. The exact vulnerable parameter and DOM sink are not described in the available sources; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation, and the advisory reference does not state a fixed version.
Local file inclusion in the AncoraThemes 'Your Dress' WordPress theme, affecting versions from the initial release through 1.4.1, allows unauthenticated remote attackers to drive PHP include/require statements toward unintended local file paths, exposing sensitive content such as wp-config.php and its database credentials. The published CVSS 3.1 base score is 8.1, while our independent assessment scopes the demonstrated impact to confidentiality loss on sites where this specific theme is installed and active. No CISA KEV entry exists and no public exploit was identified at time of analysis; the only reference is the Patchstack database advisory, so this is a priority item for inventory and cleanup rather than a confirmed active campaign.
PHP object injection in the axiomthemes Holistic Center WordPress theme through 1.2.6 exposes a deserialization path for attacker-controlled serialized input, and the input assigns CVSS 9.8 with an act_now priority. The independent assessment records AC:H because concrete impact depends on a usable POP or magic-method gadget chain in the theme, WordPress core, or co-installed plugins, and the supplied sources do not identify the vulnerable sink, exact trigger, or a working chain. No public exploit is identified at time of analysis, and exposure is limited to sites running this theme at an affected version.
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.
PHP object injection in the ThemeREX Save Life WordPress theme through version 1.2.14 lets remote attackers route crafted serialized data into an unsafe unserialize() path, scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The specific feature, parameter or endpoint that reaches the deserialization sink is not described in the available sources, and a usable POP gadget chain in the theme, an installed plugin or WordPress core is unconfirmed, so realized impact may be narrower than the score implies. No CISA KEV entry or public exploit code is associated with this CVE in the supplied intelligence, although the vuln.today decision label is act_now.
PHP object injection in the ThemeREX Group HotLock WordPress theme through version 1.3.9 can let an attacker who reaches a deserialization sink supply serialized data that instantiates arbitrary PHP objects, with severe confidentiality, integrity and availability impact if a usable gadget chain is loadable. The CVSS vector rates the issue 9.8 with network reachability, no required privileges and no user interaction, although the specific vulnerable feature or parameter is not described in the provided sources and the unauthenticated path should be confirmed against the Patchstack advisory. No public exploit was identified at time of analysis, and the act_now priority rests on limited sourcing rather than confirmed exploitation.
Unauthenticated PHP object injection in the ThemeREX Helion WordPress theme, affecting versions up to and including 1.1.12, carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated for remediation this week. Because the vector is PR:N and UI:N, any remote attacker who can reach the theme's vulnerable deserialization path needs neither credentials nor victim interaction, though the AC:H rating reflects that the high confidentiality, integrity and availability impact depends on a usable PHP gadget chain being present in the theme, an installed plugin, or WordPress core - a condition the available sources do not confirm. The specific feature, endpoint or parameter that performs the unsafe deserialization is not described in the available sources, and no public exploit code or active exploitation is identified in the available intelligence. Sites are exposed only where the vulnerable Helion theme is installed and active at version 1.1.12 or earlier.
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.
PHP object injection in the ThemeREX 'Vagabonds' WordPress theme (all versions through 1.3.10) lets remote unauthenticated attackers pass untrusted serialized data into PHP's unserialize() path, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and full High confidentiality, integrity and availability impact per the assessed vector. The concrete endpoint or parameter that feeds attacker data into the unserializer is not described in the available sources, and real-world impact - code execution, file read/write, or denial of service - depends on a usable POP gadget chain being reachable in the theme, an installed plugin, or WordPress core, which is not confirmed in the data. Exploitation presupposes the Vagabonds theme is installed and active at version 1.3.10 or below; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority label from the reporting intelligence.
PHP object injection in the axiomthemes Reprizo WordPress theme, versions through 1.0.8, lets remote attackers supply serialized data that the theme passes to an unsafe deserialization call, potentially leading to object injection in the WordPress runtime. The vendor-assigned CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the priority decision is act_now given the network-reachable, pre-auth vector claimed by the score; only sites running this specific theme at 1.0.8 or earlier are in scope. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not in CISA KEV, and realistic impact hinges on whether a usable POP gadget chain exists in the theme or an accompanying plugin, which the available sources do not confirm.
PHP object injection in the Axiomthemes Rhodos WordPress theme, affecting versions through 1.3.3, allows remote attackers to feed untrusted serialized data into a PHP unserialize() sink; the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N with 9.8 severity, so no authentication or user interaction is required per those metrics. Beyond the injection itself, meaningful impact depends on whether a usable POP gadget chain is loadable in the theme or in co-installed plugins, which the available sources do not confirm; the trigger endpoint, parameter and configuration are not described in the available sources. No CISA KEV entry or confirmed public exploit is indicated at time of analysis, and the vuln.today decision label is act_now based on the Patchstack report.
PHP object injection in ThemeREX Group's Little Birdies WordPress theme, affecting all versions through 1.3.16, lets unauthenticated remote attackers feed attacker-controlled serialized data into an unsafe deserialization sink reachable over the network, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity and availability impact in the assessed worst case. The realistic ceiling depends on gadget availability: object injection only escalates to code execution or comparable compromise where a usable POP chain exists in the theme, an installed plugin or WordPress core, and without one the practical impact may be well below the headline rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor-neutral Patchstack disclosure and the act_now priority label make this a patch-now item for any site running the theme.
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.
Reflected cross-site scripting in the Hogash KALLYAS WordPress theme through version 4.25.0 allows remote attackers to execute script in a victim’s browser when the victim follows a crafted URL. The attacker does not need authentication but must induce user interaction, and the payload is reflected per request rather than persisted server-side; the vulnerable parameter is not identified in the available sources. No public exploit identified at time of analysis, and the supplied priority label places this in the this_week queue.
Reflected cross-site scripting in the ThemeGrill eStore WordPress theme through version 1.6.13 allows remote attackers to execute arbitrary script in a victim's browser when the victim opens a crafted URL, with no attacker authentication required but mandatory user interaction. The flaw is CWE-79 and is limited to the victim's session context; no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact and no availability impact.
Reflected cross-site scripting (XSS) in the Houzez WordPress theme (versions up to and including 4.4.0) allows remote attackers to execute arbitrary script in a victim's browser by tricking them into clicking a crafted URL while the theme is active. The flaw requires user interaction (UI:R) and is unauthenticated from the attacker's side (PR:N), but since it is reflected and not stored, each victim must be individually targeted via phishing or a malicious link. No public exploit code or confirmed active exploitation was identified in the available intelligence at the time of analysis; the assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Reflected cross-site scripting in the 8theme XStore WordPress theme affects all installations running a version before 9.7.9, allowing remote attackers to inject script that executes in the browser of a site visitor who loads a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the flaw is network-reachable at low complexity and requires no authentication, but it does require the victim to click or load an attacker-supplied link (UI:R), and the scope change (S:C) means the injected script runs in the victim's browser context rather than on the server. Impact is limited to the victim's browser session within the site origin; because the payload is reflected and not stored, each victim must be individually lured, and no public exploit code was identified at time of analysis. A vendor fix is available in version 9.7.9 per the Patchstack advisory.
Reflected cross-site scripting in the ThemeREX Group "Kids Planet" WordPress theme (all versions through 2.2.14.2) lets a remote, unauthenticated attacker lure a victim to a crafted link that causes attacker-controlled script to execute in the victim's browser within the context of the affected site. Because the injected code inherits the browsing context of whoever clicks the link, a logged-in administrator is the highest-value target, where the flaw can enable session or content manipulation; the required user interaction (UI:R) is the key limiting factor and rules out unattended, automatable exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor score of 7.1 reflects moderate confidentiality, integrity, and availability weighting.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Arbitrary file deletion in the ChimpStudio FoodBakery WordPress theme (versions up to and including 4.6) allows an authenticated attacker holding only a Subscriber-level account to delete arbitrary files on the server, with no user interaction required. The underlying path traversal flaw (CWE-22) lets a crafted request escape the intended directory and reach sensitive files such as wp-config.php, so the scope change (S:C) escalates impact beyond availability loss toward full site compromise. Rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit identified at time of analysis, and exploitation is gated by whether the site permits attackers to hold a Subscriber account, which is trivial on sites with open self-registration and meaningfully harder where registration is disabled or restricted.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP Object Injection in the Anesta WordPress theme (versions up to and including 1.5.3) lets a remote attacker supply a crafted serialized payload that is passed to an unsafe unserialize() call in the theme's code. Because exploitation needs no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), the realistic impact hinges on whether the site exposes a usable POP gadget chain in the theme, WordPress core, or another active plugin - if such a chain exists, the injected object can trigger file operations, SQL, or code execution with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was included in the available intelligence; the vulnerable endpoint/parameter is not named in the supplied data and should be confirmed from the Patchstack advisory.
Unauthenticated local file inclusion in the Ambient WordPress theme (Elated Themes) at version 1.7 and earlier lets remote attackers coerce the PHP template loader into reading files outside the intended theme path, exposing secrets such as wp-config.php, database credentials, and other server-side data that is echoed back in the response. The vendor vector (AV:N/AC:H/PR:N/UI:N, score 8.1) requires no authentication or user interaction, but the HIGH attack complexity signals a precondition outside the attacker's control must line up for exploitation, so this is not a trivial one-request compromise of every site; our reassessment retains the confidentiality impact while dropping the unconfirmed integrity and availability components. Exposure is limited to WordPress installations running Ambient at 1.7 or below, and no public exploit code has been identified at time of analysis.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Reflected cross-site scripting in the KuteShop WordPress theme (versions 4.2.9 and earlier) lets remote, unauthenticated attackers inject arbitrary script into a page that executes in a victim's browser once that victim clicks a crafted URL. The attack requires user interaction (UI:R) and a site running the vulnerable theme version, which limits automation; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided. Impact scales with the victim's privileges, since a script executing in an administrator's session can be leveraged for session theft or privileged actions, which is why the flaw carries a CVSS 3.1 base score of 7.1.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.
Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.
Reflected cross-site scripting in the Biolife WordPress theme (versions up to and including 3.2.3) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them into clicking a crafted link containing a malicious payload. The vulnerability is network-reachable with low attack complexity but requires user interaction (UI:R) and crosses a scope boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L). No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.
Reflected cross-site scripting in the TechOne WordPress theme by Kutethemes, affecting all versions up to and including 3.0.3, lets an unauthenticated attacker run arbitrary JavaScript in a site visitor's browser by luring that visitor to a crafted URL that carries the payload into an unsanitized, reflected input. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment); because the payload is reflected rather than stored, the mandatory victim interaction is the key limiting factor and no server-side foothold is obtained. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue was reported by Patchstack.
Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.
Reflected cross-site scripting in the Armania WordPress theme by KuteThemes, affecting all versions through 1.4.8, allows unauthenticated remote attackers to execute arbitrary script in a victim's browser session if they are induced to open a crafted link. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the scope change reflecting that the injected script runs in the context of the affected WordPress site rather than the attacker's origin; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The practical impact is escalation of the attacker's footprint within the victim's session - most severe when the tricked user is an authenticated administrator - but the attack depends entirely on successful social engineering and does not alter server-side state.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
Unauthenticated attackers can tamper with WordPress sites running the ThemeGoods DK theme at version 3.2.1 or earlier by abusing theme functionality that lacks an authorization check (CWE-862), rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning integrity-only impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this reads as a moderate rather than emergency priority; the dominant limiting factor is product reach, since only sites that installed and activated this specific commercial theme are affected. Neither the vulnerable endpoint nor a patched version is disclosed in the available data, which leaves defenders without a precise target for either exploitation or mitigation.
Unauthenticated attackers can abuse missing authorization checks in the ThemeGoods Grand News WordPress theme (versions 3.4 and earlier) to carry out state-changing actions they should not be permitted to perform, modifying site integrity without valid credentials or any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable, low-complexity, and unauthenticated, but its impact is deliberately narrow: integrity only, with no data disclosure or availability loss. No public exploit code or active exploitation has been identified at time of analysis.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Unauthenticated cross-site scripting in the Jannah WordPress theme affects all versions up to and including 7.6.5, allowing remote attackers to inject script that executes in a victim's browser within the affected site's origin. Exploitation requires the victim to interact with attacker-controlled input (CVSS UI:R) and no attacker authentication is required (PR:N), but impact is confined to the client-side session rather than the server, so real-world severity depends heavily on whether the victim is a logged-in administrator or an anonymous visitor. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the CVSS 7.1 score reflects the mandatory user interaction and limited confidentiality, integrity, and availability impact, with scope change (S:C) indicating the payload can affect resources beyond the vulnerable component's security realm.
Reflected cross-site scripting in the Martfury - WooCommerce Marketplace WordPress theme (all versions through 3.3.9) allows unauthenticated remote attackers to have attacker-supplied script execute in the browser of a victim who opens a crafted link or request against a site running the theme. Because the flaw is reflected rather than stored, exploitation requires victim user interaction (CVSS UI:R) and cannot be triggered passively against the server, yet the scope change (S:C) means injected script can act beyond the vulnerable component with low confidentiality, integrity, and availability impact, giving a CVSS 3.1 base score of 7.1. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerable parameter or endpoint is not disclosed in the available data.
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.
Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.
PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
Unauthenticated PHP Object Injection in the ThemeREX Group Camelia WordPress theme (versions through 1.2.15) lets a remote attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling injection of arbitrary PHP objects into the application's execution flow. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no authentication and no user interaction are required, and the potential impact spans full loss of confidentiality, integrity, and availability - typically realized as remote code execution, arbitrary file manipulation, or SQL injection when a usable POP gadget chain is reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); practical exploitability is gated by the availability of a viable gadget chain across the theme, WordPress core, or co-installed plugins.
Unauthenticated PHP object injection in the ThemeREX Convex WordPress theme (versions through 1.16.0) allows remote attackers to pass crafted serialized data to an unserialize() call, potentially leading to remote code execution, file manipulation, or SQL injection if a suitable POP gadget chain is present. The vulnerability is network-reachable with no authentication or user interaction required, but successful exploitation is dependent on the target environment loading a reachable gadget chain in the theme, an active plugin, or WordPress core; independent analysis therefore rates complexity as high (AC:H) despite the original Patchstack CVSS score of 9.8 (AC:L). No public exploit code or confirmed active exploitation has been identified at time of analysis.
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.
PHP object injection in the AivahThemes Hostme v2 WordPress theme (all versions through 7.0) allows unauthenticated remote attackers to pass serialized data into a PHP unserialize() sink, which can lead to arbitrary object instantiation and, where a usable gadget chain exists, code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) confirms no authentication or user interaction is required, so any site running the theme with the affected code path active is exposed. A public PoC reference exists in the Patchstack advisory; it is not verified as working exploit code, and no CISA KEV entry indicates confirmed active exploitation. The precise request parameter or endpoint that reaches the sink is not described in the available sources, and no fixed version is listed in the evidence.
DOM-based cross-site scripting in the AivahThemes Hostme v2 WordPress theme (versions through 7.0) allows remote attackers to execute script in a victim's browser session on an affected site. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L): no attacker authentication is required, but exploitation depends on a targeted victim visiting or clicking attacker-supplied content that the theme's client-side JavaScript renders into the DOM without neutralization, and the scope change means injected code can act beyond the vulnerable component. The exact vulnerable parameter and DOM sink are not described in the available sources; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation, and the advisory reference does not state a fixed version.
Local file inclusion in the AncoraThemes 'Your Dress' WordPress theme, affecting versions from the initial release through 1.4.1, allows unauthenticated remote attackers to drive PHP include/require statements toward unintended local file paths, exposing sensitive content such as wp-config.php and its database credentials. The published CVSS 3.1 base score is 8.1, while our independent assessment scopes the demonstrated impact to confidentiality loss on sites where this specific theme is installed and active. No CISA KEV entry exists and no public exploit was identified at time of analysis; the only reference is the Patchstack database advisory, so this is a priority item for inventory and cleanup rather than a confirmed active campaign.
PHP object injection in the axiomthemes Holistic Center WordPress theme through 1.2.6 exposes a deserialization path for attacker-controlled serialized input, and the input assigns CVSS 9.8 with an act_now priority. The independent assessment records AC:H because concrete impact depends on a usable POP or magic-method gadget chain in the theme, WordPress core, or co-installed plugins, and the supplied sources do not identify the vulnerable sink, exact trigger, or a working chain. No public exploit is identified at time of analysis, and exposure is limited to sites running this theme at an affected version.
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.
PHP object injection in the ThemeREX Save Life WordPress theme through version 1.2.14 lets remote attackers route crafted serialized data into an unsafe unserialize() path, scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The specific feature, parameter or endpoint that reaches the deserialization sink is not described in the available sources, and a usable POP gadget chain in the theme, an installed plugin or WordPress core is unconfirmed, so realized impact may be narrower than the score implies. No CISA KEV entry or public exploit code is associated with this CVE in the supplied intelligence, although the vuln.today decision label is act_now.
PHP object injection in the ThemeREX Group HotLock WordPress theme through version 1.3.9 can let an attacker who reaches a deserialization sink supply serialized data that instantiates arbitrary PHP objects, with severe confidentiality, integrity and availability impact if a usable gadget chain is loadable. The CVSS vector rates the issue 9.8 with network reachability, no required privileges and no user interaction, although the specific vulnerable feature or parameter is not described in the provided sources and the unauthenticated path should be confirmed against the Patchstack advisory. No public exploit was identified at time of analysis, and the act_now priority rests on limited sourcing rather than confirmed exploitation.
Unauthenticated PHP object injection in the ThemeREX Helion WordPress theme, affecting versions up to and including 1.1.12, carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated for remediation this week. Because the vector is PR:N and UI:N, any remote attacker who can reach the theme's vulnerable deserialization path needs neither credentials nor victim interaction, though the AC:H rating reflects that the high confidentiality, integrity and availability impact depends on a usable PHP gadget chain being present in the theme, an installed plugin, or WordPress core - a condition the available sources do not confirm. The specific feature, endpoint or parameter that performs the unsafe deserialization is not described in the available sources, and no public exploit code or active exploitation is identified in the available intelligence. Sites are exposed only where the vulnerable Helion theme is installed and active at version 1.1.12 or earlier.
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.
PHP object injection in the ThemeREX 'Vagabonds' WordPress theme (all versions through 1.3.10) lets remote unauthenticated attackers pass untrusted serialized data into PHP's unserialize() path, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and full High confidentiality, integrity and availability impact per the assessed vector. The concrete endpoint or parameter that feeds attacker data into the unserializer is not described in the available sources, and real-world impact - code execution, file read/write, or denial of service - depends on a usable POP gadget chain being reachable in the theme, an installed plugin, or WordPress core, which is not confirmed in the data. Exploitation presupposes the Vagabonds theme is installed and active at version 1.3.10 or below; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority label from the reporting intelligence.
PHP object injection in the axiomthemes Reprizo WordPress theme, versions through 1.0.8, lets remote attackers supply serialized data that the theme passes to an unsafe deserialization call, potentially leading to object injection in the WordPress runtime. The vendor-assigned CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the priority decision is act_now given the network-reachable, pre-auth vector claimed by the score; only sites running this specific theme at 1.0.8 or earlier are in scope. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not in CISA KEV, and realistic impact hinges on whether a usable POP gadget chain exists in the theme or an accompanying plugin, which the available sources do not confirm.
PHP object injection in the Axiomthemes Rhodos WordPress theme, affecting versions through 1.3.3, allows remote attackers to feed untrusted serialized data into a PHP unserialize() sink; the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N with 9.8 severity, so no authentication or user interaction is required per those metrics. Beyond the injection itself, meaningful impact depends on whether a usable POP gadget chain is loadable in the theme or in co-installed plugins, which the available sources do not confirm; the trigger endpoint, parameter and configuration are not described in the available sources. No CISA KEV entry or confirmed public exploit is indicated at time of analysis, and the vuln.today decision label is act_now based on the Patchstack report.
PHP object injection in ThemeREX Group's Little Birdies WordPress theme, affecting all versions through 1.3.16, lets unauthenticated remote attackers feed attacker-controlled serialized data into an unsafe deserialization sink reachable over the network, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity and availability impact in the assessed worst case. The realistic ceiling depends on gadget availability: object injection only escalates to code execution or comparable compromise where a usable POP chain exists in the theme, an installed plugin or WordPress core, and without one the practical impact may be well below the headline rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the vendor-neutral Patchstack disclosure and the act_now priority label make this a patch-now item for any site running the theme.
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.
Reflected cross-site scripting in the Hogash KALLYAS WordPress theme through version 4.25.0 allows remote attackers to execute script in a victim’s browser when the victim follows a crafted URL. The attacker does not need authentication but must induce user interaction, and the payload is reflected per request rather than persisted server-side; the vulnerable parameter is not identified in the available sources. No public exploit identified at time of analysis, and the supplied priority label places this in the this_week queue.
Reflected cross-site scripting in the ThemeGrill eStore WordPress theme through version 1.6.13 allows remote attackers to execute arbitrary script in a victim's browser when the victim opens a crafted URL, with no attacker authentication required but mandatory user interaction. The flaw is CWE-79 and is limited to the victim's session context; no public exploit was identified at time of analysis. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting low confidentiality and integrity impact and no availability impact.
Reflected cross-site scripting (XSS) in the Houzez WordPress theme (versions up to and including 4.4.0) allows remote attackers to execute arbitrary script in a victim's browser by tricking them into clicking a crafted URL while the theme is active. The flaw requires user interaction (UI:R) and is unauthenticated from the attacker's side (PR:N), but since it is reflected and not stored, each victim must be individually targeted via phishing or a malicious link. No public exploit code or confirmed active exploitation was identified in the available intelligence at the time of analysis; the assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Reflected cross-site scripting in the 8theme XStore WordPress theme affects all installations running a version before 9.7.9, allowing remote attackers to inject script that executes in the browser of a site visitor who loads a crafted URL. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the flaw is network-reachable at low complexity and requires no authentication, but it does require the victim to click or load an attacker-supplied link (UI:R), and the scope change (S:C) means the injected script runs in the victim's browser context rather than on the server. Impact is limited to the victim's browser session within the site origin; because the payload is reflected and not stored, each victim must be individually lured, and no public exploit code was identified at time of analysis. A vendor fix is available in version 9.7.9 per the Patchstack advisory.
Reflected cross-site scripting in the ThemeREX Group "Kids Planet" WordPress theme (all versions through 2.2.14.2) lets a remote, unauthenticated attacker lure a victim to a crafted link that causes attacker-controlled script to execute in the victim's browser within the context of the affected site. Because the injected code inherits the browsing context of whoever clicks the link, a logged-in administrator is the highest-value target, where the flaw can enable session or content manipulation; the required user interaction (UI:R) is the key limiting factor and rules out unattended, automatable exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor score of 7.1 reflects moderate confidentiality, integrity, and availability weighting.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Cross-site scripting in the Educavo WordPress theme through version 3.4.2 lets unauthenticated attackers get malicious script executed in the browser of a victim who is induced to load attacker-influenced content, with the change-of-scope vector (CVSS 7.1) reflecting that the injected code runs in the context of the targeted site. Exploitation requires user interaction, so delivery is effectively targeted (a crafted link or payload aimed at a site visitor or administrator) rather than automated mass compromise, and no public exploit code was identified at time of analysis. This is a moderate-priority issue rather than a critical one, and its reach is further limited to sites that actually run this specific theme.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated reflected cross-site scripting in the Designthemes LMS WordPress theme versions 8.3 and earlier allows remote attackers to inject arbitrary script into a victim's browser session if the victim clicks a crafted link or loads an attacker-controlled request that reflects the payload; the flaw is rated CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and was reported by Patchstack. The affected theme must be installed and active on the target WordPress site, and exploitation requires user interaction (UI:R), so it is not exploitable without tricking a user; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Arbitrary file deletion in the ChimpStudio FoodBakery WordPress theme (versions up to and including 4.6) allows an authenticated attacker holding only a Subscriber-level account to delete arbitrary files on the server, with no user interaction required. The underlying path traversal flaw (CWE-22) lets a crafted request escape the intended directory and reach sensitive files such as wp-config.php, so the scope change (S:C) escalates impact beyond availability loss toward full site compromise. Rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H); no public exploit identified at time of analysis, and exploitation is gated by whether the site permits attackers to hold a Subscriber account, which is trivial on sites with open self-registration and meaningfully harder where registration is disabled or restricted.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP Object Injection in the Anesta WordPress theme (versions up to and including 1.5.3) lets a remote attacker supply a crafted serialized payload that is passed to an unsafe unserialize() call in the theme's code. Because exploitation needs no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), the realistic impact hinges on whether the site exposes a usable POP gadget chain in the theme, WordPress core, or another active plugin - if such a chain exists, the injected object can trigger file operations, SQL, or code execution with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was included in the available intelligence; the vulnerable endpoint/parameter is not named in the supplied data and should be confirmed from the Patchstack advisory.
Unauthenticated local file inclusion in the Ambient WordPress theme (Elated Themes) at version 1.7 and earlier lets remote attackers coerce the PHP template loader into reading files outside the intended theme path, exposing secrets such as wp-config.php, database credentials, and other server-side data that is echoed back in the response. The vendor vector (AV:N/AC:H/PR:N/UI:N, score 8.1) requires no authentication or user interaction, but the HIGH attack complexity signals a precondition outside the attacker's control must line up for exploitation, so this is not a trivial one-request compromise of every site; our reassessment retains the confidentiality impact while dropping the unconfirmed integrity and availability components. Exposure is limited to WordPress installations running Ambient at 1.7 or below, and no public exploit code has been identified at time of analysis.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Reflected cross-site scripting in the KuteShop WordPress theme (versions 4.2.9 and earlier) lets remote, unauthenticated attackers inject arbitrary script into a page that executes in a victim's browser once that victim clicks a crafted URL. The attack requires user interaction (UI:R) and a site running the vulnerable theme version, which limits automation; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided. Impact scales with the victim's privileges, since a script executing in an administrator's session can be leveraged for session theft or privileged actions, which is why the flaw carries a CVSS 3.1 base score of 7.1.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.
Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.
Reflected cross-site scripting in the Biolife WordPress theme (versions up to and including 3.2.3) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them into clicking a crafted link containing a malicious payload. The vulnerability is network-reachable with low attack complexity but requires user interaction (UI:R) and crosses a scope boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L). No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.
Reflected cross-site scripting in the TechOne WordPress theme by Kutethemes, affecting all versions up to and including 3.0.3, lets an unauthenticated attacker run arbitrary JavaScript in a site visitor's browser by luring that visitor to a crafted URL that carries the payload into an unsanitized, reflected input. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment); because the payload is reflected rather than stored, the mandatory victim interaction is the key limiting factor and no server-side foothold is obtained. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue was reported by Patchstack.
Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.
Reflected cross-site scripting in the Armania WordPress theme by KuteThemes, affecting all versions through 1.4.8, allows unauthenticated remote attackers to execute arbitrary script in a victim's browser session if they are induced to open a crafted link. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the scope change reflecting that the injected script runs in the context of the affected WordPress site rather than the attacker's origin; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The practical impact is escalation of the attacker's footprint within the victim's session - most severe when the tricked user is an authenticated administrator - but the attack depends entirely on successful social engineering and does not alter server-side state.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Reflected cross-site scripting in the an-themes Pin WP WordPress theme (versions 7.0 and earlier) allows an unauthenticated remote attacker to execute arbitrary script in a victim's browser by luring them to a specially crafted URL that reflects unsanitized input. Exploitation is gated by mandatory user interaction - no credentials are required, but the payload only fires if the victim clicks the attacker-supplied link - and the impact is worst when that victim is a logged-in site administrator, since the injected script inherits the site's origin (CVSS 7.1, S:C). No CISA KEV entry, no confirmed public exploit code, and no vendor-released patch were present in the available intelligence, so this rates as a moderate-risk, not top-priority, issue that nevertheless warrants prompt attention because of the volume of unauthenticated attackers who could attempt it.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Reflected cross-site scripting in the Ambed WordPress theme (all versions up to and including 1.0.0) allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser by delivering a crafted link that reflects unsanitized input through the theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) confirms the attack is network-reachable, low complexity, and requires no privileges to send, but it cannot succeed without convincing a targeted user - typically a logged-in administrator or a site visitor - to click the crafted URL. Only sites actively running the Ambed theme at 1.0.0 or earlier are exposed, there is no confirmed actively exploited status (not in CISA KEV) and no public exploit code identified at time of analysis, and because the vector is reflected rather than stored, the payload must be re-delivered for each victim.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
Unauthenticated attackers can tamper with WordPress sites running the ThemeGoods DK theme at version 3.2.1 or earlier by abusing theme functionality that lacks an authorization check (CWE-862), rated 7.5 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning integrity-only impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and no EPSS score was supplied, so this reads as a moderate rather than emergency priority; the dominant limiting factor is product reach, since only sites that installed and activated this specific commercial theme are affected. Neither the vulnerable endpoint nor a patched version is disclosed in the available data, which leaves defenders without a precise target for either exploitation or mitigation.
Unauthenticated attackers can abuse missing authorization checks in the ThemeGoods Grand News WordPress theme (versions 3.4 and earlier) to carry out state-changing actions they should not be permitted to perform, modifying site integrity without valid credentials or any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) confirms the flaw is network-reachable, low-complexity, and unauthenticated, but its impact is deliberately narrow: integrity only, with no data disclosure or availability loss. No public exploit code or active exploitation has been identified at time of analysis.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Unauthenticated cross-site scripting in the Jannah WordPress theme affects all versions up to and including 7.6.5, allowing remote attackers to inject script that executes in a victim's browser within the affected site's origin. Exploitation requires the victim to interact with attacker-controlled input (CVSS UI:R) and no attacker authentication is required (PR:N), but impact is confined to the client-side session rather than the server, so real-world severity depends heavily on whether the victim is a logged-in administrator or an anonymous visitor. No public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); the CVSS 7.1 score reflects the mandatory user interaction and limited confidentiality, integrity, and availability impact, with scope change (S:C) indicating the payload can affect resources beyond the vulnerable component's security realm.
Reflected cross-site scripting in the Martfury - WooCommerce Marketplace WordPress theme (all versions through 3.3.9) allows unauthenticated remote attackers to have attacker-supplied script execute in the browser of a victim who opens a crafted link or request against a site running the theme. Because the flaw is reflected rather than stored, exploitation requires victim user interaction (CVSS UI:R) and cannot be triggered passively against the server, yet the scope change (S:C) means injected script can act beyond the vulnerable component with low confidentiality, integrity, and availability impact, giving a CVSS 3.1 base score of 7.1. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the vulnerable parameter or endpoint is not disclosed in the available data.
Reflected cross-site scripting in the Bracketweb Zeinet WordPress theme (all versions through 1.0.0) allows an unauthenticated remote attacker to inject script that executes in the browser of a victim who clicks a crafted link. Because attacker-supplied input is reflected into the generated page without neutralization (CWE-79, CVSS 7.1), the injected script runs in the origin of the affected site and can steal session cookies, perform actions as the victim, or operate with administrative privileges if the clicking victim is a logged-in admin. The flaw has not been confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis; exploitation hinges on user interaction (CVSS UI:R), which is the primary limiting factor.
Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.
PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
Unauthenticated PHP Object Injection in the ThemeREX Group Camelia WordPress theme (versions through 1.2.15) lets a remote attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling injection of arbitrary PHP objects into the application's execution flow. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no authentication and no user interaction are required, and the potential impact spans full loss of confidentiality, integrity, and availability - typically realized as remote code execution, arbitrary file manipulation, or SQL injection when a usable POP gadget chain is reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); practical exploitability is gated by the availability of a viable gadget chain across the theme, WordPress core, or co-installed plugins.
Unauthenticated PHP object injection in the ThemeREX Convex WordPress theme (versions through 1.16.0) allows remote attackers to pass crafted serialized data to an unserialize() call, potentially leading to remote code execution, file manipulation, or SQL injection if a suitable POP gadget chain is present. The vulnerability is network-reachable with no authentication or user interaction required, but successful exploitation is dependent on the target environment loading a reachable gadget chain in the theme, an active plugin, or WordPress core; independent analysis therefore rates complexity as high (AC:H) despite the original Patchstack CVSS score of 9.8 (AC:L). No public exploit code or confirmed active exploitation has been identified at time of analysis.
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.