6
CVEs
5
Critical
1
High
0
KEV
0
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (28)
Wordpress Theme
26
PHP
23
Morning Records
1
Festy
1
Tourimo
1
Agora
1
Beelove
1
Pathfinder
1
Melody
1
Vegadays
1
Mr Cobbler
1
Triompher
1
Adrena
1
Otaku
1
Advice
1
Greenville
1
Abogado
1
Healthhub
1
Hypnotherapy
1
Integro
1
Playful
1
Dentalux
1
Theflash
1
Lighthouse
1
Wizor S
1
Accalia
1
Sanger
1
Unica
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65574 | Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65575 | Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65576 | Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65577 | PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65578 | PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2025-58902 | Unauthenticated Local File Inclusion in the AncoraThemes 'Lighthouse' WordPress theme (versions 1.2.12 and earlier, classified under CWE-98) lets remote attackers with no credentials coerce the theme's PHP include/require logic into loading attacker-influenced file paths. Because CWE-98 covers PHP remote/local file inclusion, a successful attack can disclose sensitive server files (wp-config.php, credentials) and, depending on server configuration, escalate to code execution, which is why NVD scores full C/I/A impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | HIGH | 8.1 | 0.3% | 40 |
No patch
|