47
CVEs
6
Critical
40
High
0
KEV
0
PoC
46
Unpatched C/H
0.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
40
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Theme
47
PHP
43
Agricola
2
The Gig
1
Towny
1
Fabric
1
Anubis
1
Katelyn
1
Crafti
1
Heartstar
1
Palatio
1
Giardino
1
Alright
1
Sweet Dessert
1
Ecogrow
1
Reprizo
1
Soleil
1
A Williams
1
Prisma
1
69 Clothing
1
Vocal
1
Wordpress Plugin
1
Athos
1
Confidant
1
Lunna
1
Ai Ann
1
Algenix
1
Pantry
1
Lione
1
Fitflex
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65571 | Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65572 | PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65579 | PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65581 | PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-22500 | A PHP object injection vulnerability exists in the Axiom Themes m2 | Construction and Tools Store theme through version 1.1.2, stemming from unsafe deserialization of untrusted data (CWE-502). This allows remote attackers to inject malicious serialized objects that can lead to arbitrary code execution or privilege escalation depending on available gadget chains in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, but the vulnerability was reported by Patchstack and affects all installations running the vulnerable theme version. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-57738 | Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2025-28953 | SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2025-53440 | Local File Inclusion in Axiomthemes Confidant WordPress theme (versions up to and including 1.4) allows remote unauthenticated attackers to include arbitrary local PHP files on the server, potentially leading to sensitive information disclosure and code execution. The vulnerability is reported by Patchstack with a CVSS 8.1 (High) rating; no public exploit identified at time of analysis and the CVE is not present in CISA KEV. The high attack complexity (AC:H) suggests exploitation requires specific conditions to be met, despite the network-reachable, no-auth attack surface. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58705 | Local file inclusion in the Axiomthemes Crafti WordPress theme (versions up to and including 1.12) allows remote unauthenticated attackers to coerce the PHP runtime into including arbitrary local files through improperly validated include/require parameters. Successful exploitation can lead to disclosure of sensitive server-side files, configuration data, and under certain conditions code execution via included content. No public exploit identified at time of analysis, but the issue is catalogued by Patchstack in their WordPress vulnerability database. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58935 | Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-53453 | PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58803 | Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%). | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58889 | Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58893 | Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%). | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2025-58894 | Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact. | HIGH | 8.1 | 0.1% | 41 |
No patch
|