6
CVEs
0
Critical
6
High
0
KEV
0
PoC
6
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
6
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Theme
27
PHP
27
Wordpress Plugin
4
Aperitif
2
Roisin
2
Neobeat
2
Gaspard
1
The Aisle Core
1
Mane
1
T Bel
1
Laurent
1
Malm
1
Flow
1
Solene Core
1
M Ne
1
Elated Listing
1
Playroom
1
L Onie
1
Konsept
1
Search Go
1
Singlemalt
1
Audrey
1
Leroux
1
Lella
1
Amoli
1
Mr Seo
1
Solene
1
Valiance
1
Gioia
1
Vino
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78478 | Local File Inclusion in the Mane WordPress theme (all versions up to and including 1.7) allows unauthenticated remote attackers to include and execute arbitrary server-side PHP files, with a realistic path to full remote code execution when file upload functionality is accessible. The CVSS 8.1 score with AC:H signals that the most severe impact - arbitrary code execution - depends on a specific precondition, most likely an attacker-controlled file already present on the server filesystem. No public exploit has been identified at time of analysis, though the LFI-to-RCE chain on WordPress is a well-understood and widely practiced attack class. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-42382 | Unauthenticated Local File Inclusion in the Audrey WordPress theme (elated-themes) affects all versions up to and including 1.5, letting remote attackers coerce the PHP application into including arbitrary files. Because CWE-98 covers PHP file-inclusion flaws, a successful include can leak sensitive files (wp-config.php, credentials) and, where remote or attacker-controlled content is includable, escalate to code execution. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, though the network-reachable, unauthenticated nature (CVSS 8.1) makes it a meaningful patching priority for sites running this theme. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-66670 | Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-66671 | Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-57793 | Local File Inclusion in the Elated-Themes 'Flow' WordPress theme (all versions up to and including 1.8) lets an authenticated attacker abuse an improperly controlled include/require path to read local files and potentially execute PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but low-privilege, high-complexity flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes from Patchstack. | HIGH | 7.5 | 0.5% | 38 |
No patch
|
| CVE-2026-65481 | Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet. | HIGH | 7.5 | 0.3% | 38 |
No patch
|