3
CVEs
0
Critical
3
High
0
KEV
0
PoC
3
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
3
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Theme
27
PHP
27
Wordpress Plugin
4
Aperitif
2
Roisin
2
Neobeat
2
Gaspard
1
The Aisle Core
1
Mane
1
T Bel
1
Laurent
1
Malm
1
Flow
1
Solene Core
1
M Ne
1
Elated Listing
1
Playroom
1
L Onie
1
Konsept
1
Search Go
1
Singlemalt
1
Audrey
1
Leroux
1
Lella
1
Amoli
1
Mr Seo
1
Solene
1
Valiance
1
Gioia
1
Vino
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78478 | Local File Inclusion in the Mane WordPress theme (all versions up to and including 1.7) allows unauthenticated remote attackers to include and execute arbitrary server-side PHP files, with a realistic path to full remote code execution when file upload functionality is accessible. The CVSS 8.1 score with AC:H signals that the most severe impact - arbitrary code execution - depends on a specific precondition, most likely an attacker-controlled file already present on the server filesystem. No public exploit has been identified at time of analysis, though the LFI-to-RCE chain on WordPress is a well-understood and widely practiced attack class. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-66670 | Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-66671 | Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations. | HIGH | 8.1 | 0.3% | 40 |
No patch
|