26
CVEs
6
Critical
20
High
0
KEV
0
PoC
26
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
20
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (28)
Wordpress Theme
26
PHP
23
Morning Records
1
Festy
1
Tourimo
1
Agora
1
Beelove
1
Pathfinder
1
Melody
1
Vegadays
1
Mr Cobbler
1
Triompher
1
Adrena
1
Otaku
1
Advice
1
Greenville
1
Abogado
1
Healthhub
1
Hypnotherapy
1
Integro
1
Playful
1
Dentalux
1
Theflash
1
Lighthouse
1
Wizor S
1
Accalia
1
Sanger
1
Unica
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65574 | Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65575 | Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65576 | Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65577 | PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65578 | PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-22507 | A PHP Object Injection vulnerability exists in AncoraThemes Beelove WordPress theme through version 1.2.6, allowing attackers to inject and deserialize untrusted objects. This insecure deserialization flaw (CWE-502) enables object injection attacks that could lead to remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. No CVSS score, EPSS data, or KEV confirmation is currently available; however, the vulnerability has been documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15515, indicating it is tracked in official vulnerability databases. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2025-58879 | Local file inclusion in AncoraThemes Festy theme for WordPress up to 1.13.0 allows unauthenticated remote attackers to read arbitrary files on the server. No known active exploitation, and EPSS indicates low probability (0.08%). Successful exploitation can expose sensitive configuration files but high attack complexity and no public exploit suggest lower immediate risk. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58885 | Local file inclusion in AncoraThemes Pathfinder WordPress theme through version 1.16 allows unauthenticated remote attackers to include arbitrary PHP files on the server, potentially leading to complete system compromise via code execution, though high attack complexity and very low exploitation probability (EPSS 0.08%) suggest limited real-world risk without specific server conditions. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58888 | Local file inclusion in AncoraThemes The Flash theme through version 1.15 enables unauthenticated attackers to read arbitrary files on the server, potentially exposing configuration files and leading to code execution. No public exploit has been identified, and EPSS probability is low (0.08%). The vulnerability is not listed in CISA KEV. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58890 | Local file inclusion vulnerability in the AncoraThemes Playful theme for WordPress up to version 1.19.0 allows unauthenticated attackers | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58891 | Local file inclusion in the AncoraThemes Sanger WordPress theme up to version 1.24.0 allows unauthenticated remote attackers to include arbitrary local files, potentially disclosing sensitive data or executing arbitrary code under specific server conditions. No evidence of active exploitation exists, and the EPSS score of 0.08% indicates low likelihood of widespread attacks. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58892 | Local file inclusion in the Tourimo WordPress theme (<=1.2.3) enables unauthenticated remote attackers to read arbitrary files and potentially execute arbitrary PHP code, leading to full site compromise. This vulnerability, reported by Patchstack, carries a CVSS score of 8.1 but has a low EPSS exploitation probability (0.08%), with no evidence of active exploitation or public exploit code. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58895 | Unauthenticated local file inclusion in AncoraThemes Integro WordPress theme ≤1.8.0 allows remote attackers to read arbitrary files on the server or potentially execute code. The vulnerability carries a CVSS 8.1 score but has low exploitation probability (EPSS 0.08%) and no evidence of active exploitation or public exploit code at the time of analysis. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58896 | Local file inclusion in the Otaku WordPress theme up to version 1.8.0 allows unauthenticated attackers to include arbitrary local PHP files, resulting in information disclosure, credential theft, or remote code execution. Exploitation requires high complexity and no public exploit or active attacks are currently confirmed. The vulnerability affects the AncoraThemes Otaku theme and is tracked as CVE-2025-58896. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58898 | Local file inclusion in AncoraThemes HealthHub WordPress theme up to version 1.3.0 permits unauthenticated attackers to read arbitrary local files via improper file path handling, potentially enabling remote code execution if a suitable upload or log chain exists. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low (0.08%). The vulnerability carries a CVSS 8.1 base score due to its unauthenticated network vector and high impact, though high attack complexity significantly limits practical exploitation. | HIGH | 8.1 | 0.1% | 41 |
No patch
|