8
CVEs
5
Critical
2
High
0
KEV
0
PoC
7
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
2
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Theme
47
PHP
43
Agricola
2
The Gig
1
Towny
1
Fabric
1
Anubis
1
Katelyn
1
Crafti
1
Heartstar
1
Palatio
1
Giardino
1
Alright
1
Sweet Dessert
1
Ecogrow
1
Reprizo
1
Soleil
1
A Williams
1
Prisma
1
69 Clothing
1
Vocal
1
Wordpress Plugin
1
Athos
1
Confidant
1
Lunna
1
Ai Ann
1
Algenix
1
Pantry
1
Lione
1
Fitflex
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65571 | Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65572 | PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65579 | PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-65581 | PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-57738 | Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2026-22325 | Unauthenticated local file inclusion in the Promo WordPress theme through version 1.3.0 allows remote attackers to coerce the application into including arbitrary PHP files from the server, potentially leading to source code disclosure, sensitive file reads, or remote code execution where attacker-controlled files are reachable. The vulnerability is reported by Patchstack and affects axiomthemes' Promo theme; no public exploit identified at time of analysis and EPSS data was not provided. The CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability despite high attack complexity. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-22326 | Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-27377 | Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue. | MEDIUM | 6.7 | 0.3% | 34 |
No patch
|