5
CVEs
0
Critical
5
High
0
KEV
0
PoC
5
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
5
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (16)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78566 | Local File Inclusion in Edge-Themes' Shuffle WordPress theme (all versions through 1.8) exposes WordPress installations to unauthenticated remote code execution. An attacker without any credentials can supply a crafted path parameter to the theme's PHP include logic, causing the server to load and execute arbitrary PHP files - including attacker-uploaded content disguised as images. No public exploit has been identified at time of analysis, but the attack pattern (LFI chained with WordPress media uploads) is well-documented in the ecosystem, and the unauthenticated network vector warrants prompt remediation. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-66653 | Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2025-15637 | Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-57788 | Local File Inclusion in the Edge-Themes "Aalto" WordPress theme (all versions up to and including 1.8) lets an authenticated attacker control a filename passed to a PHP include/require statement, exposing local files and potentially executing PHP. The flaw was reported by Patchstack and carries CVSS 7.5; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Despite the CWE-98 "Remote File Inclusion" classification, the described impact is Local File Inclusion. | HIGH | 7.5 | 0.5% | 38 |
No patch
|
| CVE-2026-57800 | Local File Inclusion in the Edge-Themes 'Overworld' WordPress theme (versions up to and including 1.5) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary server-side files, disclosing sensitive data such as wp-config.php credentials and potentially escalating to code execution via log/session poisoning. The flaw was reported by Patchstack and is classified as CWE-98 (PHP Remote File Inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided. | HIGH | 7.5 | 0.5% | 38 |
No patch
|