Wordpress Theme
Monthly
PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.
PHP object injection in the Partiso WordPress theme (ThemeREX Group) through version 1.1.13 allows unauthenticated remote attackers to pass attacker-controlled serialized data into unserialize(), which per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector requires no credentials and no user interaction on a default installation. The 9.8 severity reflects the theoretical worst case of high confidentiality, integrity and availability impact, but actual exploitation depends on the presence of a usable POP gadget chain in the theme, a co-installed plugin, or WordPress core - without such a chain the practical impact is materially lower. No vendor-released patch version is stated in the available data, and no public exploit code was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.
PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
Unauthenticated remote attackers can invoke privileged actions or modify site data in the StylemixThemes Motors WordPress theme (versions through 1.4.108) due to missing authorization checks (CWE-862). The flaw is network-reachable with low complexity and requires no authentication or user interaction, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 7.5). No public exploit identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
WordPress sites running the BuddhaThemes ColorFolio theme (directory slug 'colorit') through version 1.3 expose an authenticated PHP object injection path, because the theme deserializes untrusted input without validating it (CWE-502), letting an attacker with a low-privilege account on the site supply crafted serialized data. CVSS 3.1 rates it 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, low-complexity, and needs no victim interaction, but full confidentiality, integrity, and availability impact is gated on the presence of a usable PHP object-injection (POP) gadget chain in the theme, WordPress core, or another installed plugin - without one the realized impact is substantially reduced. No public exploit code and no confirmed in-the-wild exploitation were identified from the available sources at time of analysis; exploitation also requires that the specific vulnerable ColorFolio version be installed and active.
PHP object injection in the BuddhaThemes Neo | Barber Shop WordPress theme (slug neocut), affecting all versions through 3.5, lets an authenticated attacker with a low-privileged account (subscriber or contributor level) deliver a crafted serialized PHP object to the theme's unsafe deserialization routine, potentially reaching high confidentiality, integrity and availability impact if a usable POP gadget chain exists. The issue carries CVSS 8.8 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Because the required authentication level, the niche deployment of this specific theme, and the dependence on gadget-chain availability all limit practical exploitation, this is a genuine high-priority issue but short of critical-emergency status.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Reflected cross-site scripting in the Designthemes 'Whistle - Sports Club' WordPress theme (all versions through 4.2) allows unauthenticated remote attackers to inject and execute arbitrary script in a victim's browser by convincing that victim to open a crafted link; the payload is reflected in the response rather than stored. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the attack is network-reachable and requires no authentication, but is gated by user interaction, and the non-persistent reflected nature rules out broad automated or drive-by compromise. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Voldor' WordPress theme (versions up to and including 1.0.0) lets an unauthenticated remote attacker inject a malicious script into a crafted URL that executes in the browser of any victim who clicks the link while the theme is active. Exploitation requires the victim to follow the attacker-supplied URL (UI:R) and the target site to actually run this specific theme; the payload is reflected rather than stored, so it is non-persistent and limited to the victim's browser context (session or cookie theft, actions performed as the victim). Patchstack assigned CVSS 3.1 7.1 for this flaw; no public exploit code and no confirmed active exploitation were identified at the time of analysis.
Reflected cross-site scripting in the Bracketweb 'Ogency' WordPress theme (versions through 1.0.0) lets an unauthenticated remote attacker craft a URL whose parameter is echoed unsanitized into the rendered page, executing arbitrary JavaScript in the browser of any user who opens that link. The assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); successful exploitation requires victim interaction and yields no server-side compromise, but can lead to admin session/session-cookie theft or forced administrative actions given WordPress's privileged session model. No public exploit code was identified and the flaw is not in CISA KEV at time of analysis, so risk is driven by the low skill barrier for reflected XSS rather than confirmed active exploitation.
Reflected cross-site scripting in the Bracketweb 'Treck' WordPress theme (all versions through 1.0.0) allows an unauthenticated attacker to run arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL containing a malicious payload in an unsanitized, reflected parameter. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so no authentication or prior access is needed to send the request, but the victim must click the attacker-supplied link for the script to execute; impact is greatest when that victim is a logged-in WordPress administrator, since the injected script then runs inside the admin session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the theme's low deployment footprint limits real-world exposure.
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.
Reflected cross-site scripting in the ThemeGoods Grand Restaurant WordPress theme (all versions before 7.0.11) lets an unauthenticated remote attacker craft a URL that, once a victim clicks it, executes attacker-supplied script in the context of the victim's WordPress site session. The vulnerability is rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, with scope change (S:C) reflecting that the injected code runs in the victim's browser rather than affecting only the vulnerable component, and exploitation depends on social engineering because user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Only sites running this specific commercial theme below version 7.0.11 are exposed, which constrains the risk to targeted rather than automated mass attacks.
Reflected cross-site scripting in the Muffingroup Betheme WordPress theme (versions through 28.5.8) lets an unauthenticated attacker deliver a crafted URL that executes attacker-supplied script in a victim's browser once the link is loaded. Because the injection is reflected rather than stored, exploitation depends entirely on user interaction (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C), and impact is greatest when an administrator with an active session is lured into clicking the link, since the script then runs with the victim's privileges on the affected site's origin. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
Subscriber-level privilege escalation in the JobZilla - Job Board WordPress theme through version 2.2 allows an authenticated low-privilege user to elevate their permissions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The attack is network-reachable, low-complexity, and requires no user interaction; because the CVSS vector includes PR:L, the attacker must be authenticated, and in typical job-board deployments with open self-registration obtaining a Subscriber account is trivial, while sites with registration disabled still require a valid low-privilege credential first. No public exploit identified at time of analysis, so this is an actionable priority for affected sites but not an unauthenticated emergency.
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Authenticated SQL injection in the Woffice WordPress theme at versions 5.4.35 and earlier lets any Subscriber-level account supply crafted input through an as-yet-unidentified theme endpoint and read arbitrary data from the site's database, including wp_users credential material and any other records the database account can reach. Exploitation is remote (AV:N) and requires no user interaction (UI:N), but does require a valid low-privilege account (PR:L) - a barrier that is minimal on the intranet, membership and community sites Woffice targets, where open self-registration is common. Patchstack reports an 8.5 score, while our independent assessment rates it 6.5 (scope-unchanged, confidentiality-only, no integrity or availability impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and the exact vulnerable parameter must be confirmed from the Patchstack advisory.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) allows remote unauthenticated attackers to gain full control of affected sites. The compromised theme distributions ship with implanted malicious software, giving attackers a hidden channel for code execution and complete confidentiality, integrity, and availability compromise (CVSS 10.0). Reported by Patchstack; no public exploit identified at time of analysis and no CISA KEV listing.
Cross-site scripting in Uncode WordPress theme versions 2.12.7 and below allows unauthenticated attackers to inject arbitrary JavaScript that executes in victims' browsers upon interaction. The CVSS scope change (S:C) indicates injected scripts run in a security context beyond the theme itself - typically the authenticated victim's browser session - enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Local File Inclusion in Edge-Themes' Shuffle WordPress theme (all versions through 1.8) exposes WordPress installations to unauthenticated remote code execution. An attacker without any credentials can supply a crafted path parameter to the theme's PHP include logic, causing the server to load and execute arbitrary PHP files - including attacker-uploaded content disguised as images. No public exploit has been identified at time of analysis, but the attack pattern (LFI chained with WordPress media uploads) is well-documented in the ecosystem, and the unauthenticated network vector warrants prompt remediation.
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.
PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA's KEV catalog, though the Patchstack disclosure confirms the flaw exists in the released theme.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelacehq) affects all versions up to and including 7.5.4, allowing unauthenticated attackers to inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the theme itself, such as the WordPress admin session context. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no evidence of active exploitation.
Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote unauthenticated attackers reach functionality or data that should be access-restricted, due to a missing authorization check (CWE-862). Rated CVSS 7.5 with a confidentiality-only impact, the flaw was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Select-Themes "Struktur" WordPress theme (all versions up to and including 2.5.1) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive content such as wp-config.php credentials and, under the right conditions, escalating to code execution. Tracked as CVE-2026-57802 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS vector's PR:L indicates authentication is required and AC:H reflects non-trivial exploitation preconditions.
PHP Local File Inclusion in the Select-Themes SetSail WordPress theme (versions up to and including 2.1) allows an authenticated attacker to coerce the application into including local files via improper control of a filename in an include/require statement. Successful exploitation can disclose sensitive files (e.g., wp-config.php) and, depending on server conditions, escalate to code execution through log poisoning or PHP wrapper abuse. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.
Local File Inclusion in the Edge-Themes 'Overworld' WordPress theme (versions up to and including 1.5) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary server-side files, disclosing sensitive data such as wp-config.php credentials and potentially escalating to code execution via log/session poisoning. The flaw was reported by Patchstack and is classified as CWE-98 (PHP Remote File Inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local file inclusion in the uxper Nuss WordPress theme (versions up to and including 1.3.6) lets an authenticated attacker with low-privilege access coerce the theme into including arbitrary PHP-parsable files from the server via improperly controlled include/require paths (CWE-98). Successful exploitation can disclose sensitive files and, depending on what can be included, lead to code execution, with high confidentiality, integrity, and availability impact per the CVSS 7.5 rating. No public exploit identified at time of analysis; the flaw was reported through Patchstack.
Local File Inclusion in the VLThemes Leedo WordPress theme (versions up to and including 3.0.0) allows authenticated attackers to include and execute arbitrary local files on the server via improper control of a filename passed to a PHP include/require statement. Although classified under PHP Remote File Inclusion (CWE-98), Patchstack characterizes the practical impact as Local File Inclusion, enabling disclosure of sensitive files and potential code execution from locally accessible content. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Local File Inclusion in the Kitchor WordPress theme by themelexus (versions up to and including 1.4.3) allows an authenticated attacker to coerce a PHP include/require statement into loading arbitrary local files from the server. Because the theme fails to constrain the filename passed to an include path (CWE-98), an attacker with at least low-level authenticated access can read sensitive files such as wp-config.php and, under the right conditions, escalate to PHP code execution via log poisoning or inclusion of attacker-influenced content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.5.
Local File Inclusion in the Elated-Themes 'Flow' WordPress theme (all versions up to and including 1.8) lets an authenticated attacker abuse an improperly controlled include/require path to read local files and potentially execute PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but low-privilege, high-complexity flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes from Patchstack.
Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met.
Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the jwsthemes Aqua WordPress theme (versions up to and including 5.1.2) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive data and potentially achieving code execution. Reported by Patchstack under CWE-98, the flaw carries CVSS 7.5 but requires low-level privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.
PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.
PHP object injection in the Partiso WordPress theme (ThemeREX Group) through version 1.1.13 allows unauthenticated remote attackers to pass attacker-controlled serialized data into unserialize(), which per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector requires no credentials and no user interaction on a default installation. The 9.8 severity reflects the theoretical worst case of high confidentiality, integrity and availability impact, but actual exploitation depends on the presence of a usable POP gadget chain in the theme, a co-installed plugin, or WordPress core - without such a chain the practical impact is materially lower. No vendor-released patch version is stated in the available data, and no public exploit code was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.
PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
Unauthenticated remote attackers can invoke privileged actions or modify site data in the StylemixThemes Motors WordPress theme (versions through 1.4.108) due to missing authorization checks (CWE-862). The flaw is network-reachable with low complexity and requires no authentication or user interaction, resulting in a high integrity impact while confidentiality and availability are unaffected (CVSS 7.5). No public exploit identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Authentication bypass through an alternate password-recovery channel in the Omegathemes Grocery Shopping Store WordPress theme, versions through 1.3.3, can let a remote attacker with some level of privilege (PR:L per the assessed CVSS vector) manipulate the theme's password recovery/reset flow, with low integrity and high availability impact but no confidentiality impact. The CVSS 3.1 base score is 7.1 (HIGH), with network attack vector, low attack complexity, and no user interaction. No public exploit was identified at the time of analysis, and the provided intelligence does not confirm CISA KEV exploitation; the practical risk is constrained by the theme's narrow deployment footprint and the privilege requirement noted in the vector, which conflicts with the typical pre-auth nature of password-recovery bypasses and should be verified.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Reflected cross-site scripting in the SpabRice Pond WordPress theme (all versions through 2.6.1) lets a remote, unauthenticated attacker craft a URL containing a script payload that the theme reflects unsanitized into the generated page; the victim must be convinced to open that link (mandatory user interaction), so exploitation cannot occur without social engineering and nothing persists server-side. Impact per the assessed vector is low confidentiality and integrity loss with scope change, with the worst case being a lured authenticated administrator whose browser executes the script in a privileged session; no public exploit and no confirmed active exploitation were identified at time of analysis. Sites running this theme should treat the reflected payload as a phishing/CSRF-assist vector rather than a self-propagating compromise.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
WordPress sites running the BuddhaThemes ColorFolio theme (directory slug 'colorit') through version 1.3 expose an authenticated PHP object injection path, because the theme deserializes untrusted input without validating it (CWE-502), letting an attacker with a low-privilege account on the site supply crafted serialized data. CVSS 3.1 rates it 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning the flaw is network-reachable, low-complexity, and needs no victim interaction, but full confidentiality, integrity, and availability impact is gated on the presence of a usable PHP object-injection (POP) gadget chain in the theme, WordPress core, or another installed plugin - without one the realized impact is substantially reduced. No public exploit code and no confirmed in-the-wild exploitation were identified from the available sources at time of analysis; exploitation also requires that the specific vulnerable ColorFolio version be installed and active.
PHP object injection in the BuddhaThemes Neo | Barber Shop WordPress theme (slug neocut), affecting all versions through 3.5, lets an authenticated attacker with a low-privileged account (subscriber or contributor level) deliver a crafted serialized PHP object to the theme's unsafe deserialization routine, potentially reaching high confidentiality, integrity and availability impact if a usable POP gadget chain exists. The issue carries CVSS 8.8 via vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, and no public exploit code has been identified at time of analysis (no CISA KEV listing). Because the required authentication level, the niche deployment of this specific theme, and the dependence on gadget-chain availability all limit practical exploitation, this is a genuine high-priority issue but short of critical-emergency status.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Reflected cross-site scripting in the Designthemes 'Whistle - Sports Club' WordPress theme (all versions through 4.2) allows unauthenticated remote attackers to inject and execute arbitrary script in a victim's browser by convincing that victim to open a crafted link; the payload is reflected in the response rather than stored. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms the attack is network-reachable and requires no authentication, but is gated by user interaction, and the non-persistent reflected nature rules out broad automated or drive-by compromise. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis.
Reflected cross-site scripting in the Bracketweb 'Voldor' WordPress theme (versions up to and including 1.0.0) lets an unauthenticated remote attacker inject a malicious script into a crafted URL that executes in the browser of any victim who clicks the link while the theme is active. Exploitation requires the victim to follow the attacker-supplied URL (UI:R) and the target site to actually run this specific theme; the payload is reflected rather than stored, so it is non-persistent and limited to the victim's browser context (session or cookie theft, actions performed as the victim). Patchstack assigned CVSS 3.1 7.1 for this flaw; no public exploit code and no confirmed active exploitation were identified at the time of analysis.
Reflected cross-site scripting in the Bracketweb 'Ogency' WordPress theme (versions through 1.0.0) lets an unauthenticated remote attacker craft a URL whose parameter is echoed unsanitized into the rendered page, executing arbitrary JavaScript in the browser of any user who opens that link. The assessed CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); successful exploitation requires victim interaction and yields no server-side compromise, but can lead to admin session/session-cookie theft or forced administrative actions given WordPress's privileged session model. No public exploit code was identified and the flaw is not in CISA KEV at time of analysis, so risk is driven by the low skill barrier for reflected XSS rather than confirmed active exploitation.
Reflected cross-site scripting in the Bracketweb 'Treck' WordPress theme (all versions through 1.0.0) allows an unauthenticated attacker to run arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL containing a malicious payload in an unsanitized, reflected parameter. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so no authentication or prior access is needed to send the request, but the victim must click the attacker-supplied link for the script to execute; impact is greatest when that victim is a logged-in WordPress administrator, since the injected script then runs inside the admin session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the theme's low deployment footprint limits real-world exposure.
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.
Reflected cross-site scripting in the ThemeGoods Grand Restaurant WordPress theme (all versions before 7.0.11) lets an unauthenticated remote attacker craft a URL that, once a victim clicks it, executes attacker-supplied script in the context of the victim's WordPress site session. The vulnerability is rated CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, with scope change (S:C) reflecting that the injected code runs in the victim's browser rather than affecting only the vulnerable component, and exploitation depends on social engineering because user interaction is required; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. Only sites running this specific commercial theme below version 7.0.11 are exposed, which constrains the risk to targeted rather than automated mass attacks.
Reflected cross-site scripting in the Muffingroup Betheme WordPress theme (versions through 28.5.8) lets an unauthenticated attacker deliver a crafted URL that executes attacker-supplied script in a victim's browser once the link is loaded. Because the injection is reflected rather than stored, exploitation depends entirely on user interaction (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R/S:C), and impact is greatest when an administrator with an active session is lured into clicking the link, since the script then runs with the victim's privileges on the affected site's origin. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; the flaw was reported through Patchstack.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
Subscriber-level privilege escalation in the JobZilla - Job Board WordPress theme through version 2.2 allows an authenticated low-privilege user to elevate their permissions, with high impact to confidentiality, integrity, and availability (CVSS 8.8). The attack is network-reachable, low-complexity, and requires no user interaction; because the CVSS vector includes PR:L, the attacker must be authenticated, and in typical job-board deployments with open self-registration obtaining a Subscriber account is trivial, while sites with registration disabled still require a valid low-privilege credential first. No public exploit identified at time of analysis, so this is an actionable priority for affected sites but not an unauthenticated emergency.
Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation.
Reflected cross-site scripting in the EduMall WordPress theme (versions up to and including 4.5.3, published by ThemeMove) lets remote unauthenticated attackers execute arbitrary JavaScript in the browser of any user who clicks a crafted link - no login, privilege, or non-default configuration is required. Because the payload is reflected rather than stored, exploitation depends on a successful social-engineering lure against a victim (ideally an authenticated administrator) and does not affect all site visitors automatically, keeping this a moderate-priority issue rather than an emergency. No public exploit code was identified and the CVE is not listed in CISA KEV at the time of analysis.
Authenticated SQL injection in the Woffice WordPress theme at versions 5.4.35 and earlier lets any Subscriber-level account supply crafted input through an as-yet-unidentified theme endpoint and read arbitrary data from the site's database, including wp_users credential material and any other records the database account can reach. Exploitation is remote (AV:N) and requires no user interaction (UI:N), but does require a valid low-privilege account (PR:L) - a barrier that is minimal on the intranet, membership and community sites Woffice targets, where open self-registration is common. Patchstack reports an 8.5 score, while our independent assessment rates it 6.5 (scope-unchanged, confidentiality-only, no integrity or availability impact); there is no CISA KEV listing and no public exploit identified at time of analysis, and the exact vulnerable parameter must be confirmed from the Patchstack advisory.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) allows remote unauthenticated attackers to gain full control of affected sites. The compromised theme distributions ship with implanted malicious software, giving attackers a hidden channel for code execution and complete confidentiality, integrity, and availability compromise (CVSS 10.0). Reported by Patchstack; no public exploit identified at time of analysis and no CISA KEV listing.
Cross-site scripting in Uncode WordPress theme versions 2.12.7 and below allows unauthenticated attackers to inject arbitrary JavaScript that executes in victims' browsers upon interaction. The CVSS scope change (S:C) indicates injected scripts run in a security context beyond the theme itself - typically the authenticated victim's browser session - enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Local File Inclusion in Edge-Themes' Shuffle WordPress theme (all versions through 1.8) exposes WordPress installations to unauthenticated remote code execution. An attacker without any credentials can supply a crafted path parameter to the theme's PHP include logic, causing the server to load and execute arbitrary PHP files - including attacker-uploaded content disguised as images. No public exploit has been identified at time of analysis, but the attack pattern (LFI chained with WordPress media uploads) is well-documented in the ecosystem, and the unauthenticated network vector warrants prompt remediation.
Privilege escalation in the Jawn WordPress theme (by MvpThemes) affects all versions through 1.4.2, allowing an unauthenticated remote attacker to promote themselves to a full administrator account. The flaw was disclosed by Wordfence and independently catalogued by Patchstack, and its CVSS 9.8 rating reflects unauthenticated, network-reachable takeover of the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.
PHP Object Injection in the FreightCo WordPress theme (versions up to and including 1.1.15) lets remote attackers pass attacker-controlled serialized data into an unsafe unserialize() call, enabling exploitation of PHP object gadget chains. The flaw is unauthenticated (CVSS 3.1 vector PR:N) and carries a critical 9.8 base score, and per the CVSS vector it can lead to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Privilege escalation in the Jawn WordPress theme (versions ≤ 1.4.2, by mvpthemes) allows a remote, unauthenticated attacker to elevate their privileges within a WordPress site, per a Patchstack advisory. The flaw is rooted in incorrect privilege assignment (CWE-266) and carries a CVSS 9.8, implying an attacker can reach administrator-level control without credentials or user interaction. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Koji WordPress theme (versions 2.2.1 and earlier) allows unauthenticated remote attackers to access content or functionality that should be restricted, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability does not appear in CISA's KEV catalog, though the Patchstack disclosure confirms the flaw exists in the released theme.
Arbitrary file upload in the Warehouse Cargo WordPress theme (versions 2.6.9 and earlier) allows an authenticated subscriber-level user to upload malicious files, enabling remote code execution on the host. The flaw is remotely reachable and requires only the lowest privileged registered account, and its scope-changing CVSS 9.9 rating reflects potential full compromise of the underlying WordPress server. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Smart Cleaning WordPress theme (by themagnifico52) through version 4.8.6 lets a low-privileged authenticated user (Subscriber role) upload files of dangerous types, enabling likely remote code execution on the hosting server. Rated CVSS 9.9 with a scope change, the flaw is exploitable over the network with low complexity and no user interaction, though it requires a valid low-tier account. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the IT Residence WordPress theme (by indithemes), versions 3.2.1 and earlier, lets an authenticated low-privilege user (Subscriber) upload files without proper validation of type or content. Because a Subscriber is the lowest self-registerable role on many WordPress sites, an attacker who can register or obtain such an account can upload a malicious PHP payload and achieve remote code execution on the host. Reported by Patchstack; no public exploit code has been identified at time of analysis.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
PHP Object Injection in the Flatastic WordPress theme (versions 2.0 and earlier, by author monkeysan) lets unauthenticated remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, potentially achieving remote code execution, data theft, or site takeover if a suitable POP gadget chain is present in the WordPress core, plugins, or theme. Reported by Patchstack and rated CVSS 9.8, it requires no authentication or user interaction. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
SQL injection in the TheGem (Elementor) WordPress theme by CodexThemes affects all versions up to and including 5.12.3, letting unauthenticated remote attackers inject crafted SQL into a vulnerable query parameter (CWE-89). Reported by Patchstack and rated CVSS 9.3, the flaw has a network attack vector with no privileges or user interaction, exposing database contents such as credentials and configuration secrets. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, low-complexity nature makes it a strong patching priority.
Broken access control in the Chaplin WordPress theme (versions <= 2.6.8) allows unauthenticated remote attackers to access restricted content, resulting in high confidentiality impact. The flaw, classified as CWE-862 (Missing Authorization), means the theme fails to verify whether a requesting user holds the necessary permissions before granting access to protected resources. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-authentication-required attack surface makes this straightforward to exploit against any exposed WordPress installation running a vulnerable version of the theme.
Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Account takeover via broken authentication in the Cartify Multipurpose WooCommerce WordPress theme (versions <= 1.3.0.1) lets an unauthenticated remote attacker authenticate as an arbitrary user, including administrators, without valid credentials. Reported by Patchstack and rated CVSS 9.8, the flaw stems from an authentication logic error (CWE-288) that permits identity assertion through an alternate path. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelacehq) affects all versions up to and including 7.5.4, allowing unauthenticated attackers to inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the theme itself, such as the WordPress admin session context. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no evidence of active exploitation.
Sensitive information disclosure in the pixelacehq "Manual" WordPress theme (versions 7.5.4 and earlier) lets remote unauthenticated attackers reach functionality or data that should be access-restricted, due to a missing authorization check (CWE-862). Rated CVSS 7.5 with a confidentiality-only impact, the flaw was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the Select-Themes "Struktur" WordPress theme (all versions up to and including 2.5.1) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive content such as wp-config.php credentials and, under the right conditions, escalating to code execution. Tracked as CVE-2026-57802 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS vector's PR:L indicates authentication is required and AC:H reflects non-trivial exploitation preconditions.
PHP Local File Inclusion in the Select-Themes SetSail WordPress theme (versions up to and including 2.1) allows an authenticated attacker to coerce the application into including local files via improper control of a filename in an include/require statement. Successful exploitation can disclose sensitive files (e.g., wp-config.php) and, depending on server conditions, escalate to code execution through log poisoning or PHP wrapper abuse. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.
Local File Inclusion in the Edge-Themes 'Overworld' WordPress theme (versions up to and including 1.5) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary server-side files, disclosing sensitive data such as wp-config.php credentials and potentially escalating to code execution via log/session poisoning. The flaw was reported by Patchstack and is classified as CWE-98 (PHP Remote File Inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Local file inclusion in the uxper Nuss WordPress theme (versions up to and including 1.3.6) lets an authenticated attacker with low-privilege access coerce the theme into including arbitrary PHP-parsable files from the server via improperly controlled include/require paths (CWE-98). Successful exploitation can disclose sensitive files and, depending on what can be included, lead to code execution, with high confidentiality, integrity, and availability impact per the CVSS 7.5 rating. No public exploit identified at time of analysis; the flaw was reported through Patchstack.
Local File Inclusion in the VLThemes Leedo WordPress theme (versions up to and including 3.0.0) allows authenticated attackers to include and execute arbitrary local files on the server via improper control of a filename passed to a PHP include/require statement. Although classified under PHP Remote File Inclusion (CWE-98), Patchstack characterizes the practical impact as Local File Inclusion, enabling disclosure of sensitive files and potential code execution from locally accessible content. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Local File Inclusion in the Kitchor WordPress theme by themelexus (versions up to and including 1.4.3) allows an authenticated attacker to coerce a PHP include/require statement into loading arbitrary local files from the server. Because the theme fails to constrain the filename passed to an include path (CWE-98), an attacker with at least low-level authenticated access can read sensitive files such as wp-config.php and, under the right conditions, escalate to PHP code execution via log poisoning or inclusion of attacker-influenced content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.5.
Local File Inclusion in the Elated-Themes 'Flow' WordPress theme (all versions up to and including 1.8) lets an authenticated attacker abuse an improperly controlled include/require path to read local files and potentially execute PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but low-privilege, high-complexity flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes from Patchstack.
Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met.
Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the jwsthemes Aqua WordPress theme (versions up to and including 5.1.2) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive data and potentially achieving code execution. Reported by Patchstack under CWE-98, the flaw carries CVSS 7.5 but requires low-level privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.