19
CVEs
0
Critical
19
High
0
KEV
0
PoC
19
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
19
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Theme
27
PHP
27
Wordpress Plugin
4
Aperitif
2
Roisin
2
Neobeat
2
Gaspard
1
The Aisle Core
1
Mane
1
T Bel
1
Laurent
1
Malm
1
Flow
1
Solene Core
1
M Ne
1
Elated Listing
1
Playroom
1
L Onie
1
Konsept
1
Search Go
1
Singlemalt
1
Audrey
1
Leroux
1
Lella
1
Amoli
1
Mr Seo
1
Solene
1
Valiance
1
Gioia
1
Vino
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78478 | Local File Inclusion in the Mane WordPress theme (all versions up to and including 1.7) allows unauthenticated remote attackers to include and execute arbitrary server-side PHP files, with a realistic path to full remote code execution when file upload functionality is accessible. The CVSS 8.1 score with AC:H signals that the most severe impact - arbitrary code execution - depends on a specific precondition, most likely an attacker-controlled file already present on the server filesystem. No public exploit has been identified at time of analysis, though the LFI-to-RCE chain on WordPress is a well-understood and widely practiced attack class. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-39522 | Unauthenticated Local File Inclusion in the Solene WordPress theme versions 3.4 and earlier allows remote attackers to read arbitrary server-side files and potentially execute PHP code via improperly controlled filename inclusion (CWE-98). The flaw is reachable over the network without credentials, and while CVSS:3.1 rates it 8.1 (High) with high attack complexity, no public exploit identified at time of analysis. Wide impact is plausible because Solene is a commercial WordPress theme distributed by Elated Themes and exposed on internet-facing sites. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39549 | Unauthenticated local file inclusion in the Aperitif WordPress theme (versions up to and including 1.5) by elated-themes allows remote attackers to coerce the PHP include/require chain into loading attacker-controlled paths without credentials or user interaction. No public exploit identified at time of analysis, but the high CIA impact and unauthenticated network reach make it a meaningful supply-chain risk for sites using this commercial theme. The CVSS:3.1 score of 8.1 reflects high attack complexity, indicating the trigger likely requires a specific request pattern rather than a single trivial payload. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39554 | Unauthenticated PHP Object Injection in the Fidalgo WordPress theme (versions ≤1.2.2) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the theme, potentially leading to arbitrary code execution, data tampering, or service disruption depending on available gadget chains. No public exploit identified at time of analysis, but the unauthenticated network vector and CWE-502 classification make this a meaningful risk for WordPress sites running this commercial theme. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39557 | Unauthenticated PHP Object Injection in the NeoBeat WordPress theme (versions ≤1.7) allows remote attackers to inject crafted serialized objects that, when deserialized by the application, can be chained with available gadgets to compromise the site. No public exploit identified at time of analysis, but the CVSS 8.1 rating reflects high impact across confidentiality, integrity and availability if a usable gadget chain is present in the WordPress core or installed plugins. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39568 | Unauthenticated local file inclusion in the Mr. SEO WordPress theme versions 2.0 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server without authentication. The flaw, reported by Patchstack and tracked as CWE-98 (PHP Remote File Inclusion), enables information disclosure and potential remote code execution depending on what files are reachable on the host. No public exploit identified at time of analysis, though the theme's WordPress deployment context broadens the attack surface across affected sites. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39577 | PHP Object Injection in the Playroom WordPress theme (versions ≤ 1.4.1) by elated-themes allows remote attackers to inject crafted serialized objects that are deserialized by the application, potentially triggering POP-chain gadgets. The vulnerability is described as unauthenticated by Patchstack despite the CVSS vector listing PR:H, and no public exploit identified at time of analysis. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-39578 | PHP Object Injection in the Valiance WordPress theme (versions up to and including 1.2) by elated-themes allows attackers to pass attacker-controlled serialized data into a PHP unserialize() sink, enabling object injection that - when paired with a suitable gadget chain from WordPress core or another installed plugin - can lead to remote code execution, file manipulation, or data tampering. The Patchstack advisory labels the issue as unauthenticated, although the published CVSS vector lists PR:H, so the precise authentication boundary should be verified against the vendor advisory. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-40754 | Unauthenticated PHP object injection in the Roisin WordPress theme (versions up to and including 1.4) by elated-themes allows remote attackers to deliver crafted serialized payloads to vulnerable deserialization sinks, potentially leading to high-impact compromise of confidentiality, integrity, and availability. The CVSS 8.1 score reflects high attack complexity offset by the lack of any authentication or user interaction. No public exploit was identified at time of analysis, and the issue is tracked by Patchstack and ENISA (EUVD-2026-37488). | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-40758 | Unauthenticated PHP Object Injection in the Léonie WordPress theme (versions ≤ 1.2.1) by Elated Themes allows remote attackers to deserialize attacker-controlled data, potentially leading to arbitrary code execution, file manipulation, or full site compromise when a suitable POP gadget chain exists in the WordPress stack. Reported by Patchstack and tracked as EUVD-2026-37490, with no public exploit identified at time of analysis but a high CVSS score of 8.1 reflecting the severity of unauthenticated deserialization. No KEV listing is present. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-39558 | Unauthenticated local file inclusion in the Malmö WordPress theme versions 2.2 and earlier allows remote attackers to include arbitrary local files via crafted requests, enabling disclosure of sensitive server-side content and potentially remote code execution. The flaw is reported by Patchstack and classified as CWE-98 (improper control of filename for include/require), with no public exploit identified at time of analysis. Affected sites are WordPress installations using the elated-themes Malmö theme. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-39523 | Unauthenticated Local File Inclusion in the Solene Core WordPress plugin (versions <= 2.3.2) by elated-themes allows remote attackers to include and execute arbitrary local PHP files on the server without authentication. The CVSS 8.1 rating reflects full confidentiality, integrity, and availability impact, though high attack complexity suggests non-trivial exploitation prerequisites. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-39556 | Unauthenticated PHP Object Injection affects the Konsept WordPress theme (by elated-themes) in versions 1.9 and earlier, allowing remote attackers to inject crafted serialized PHP objects without authentication. Successful exploitation can lead to a full compromise of the WordPress site - high impact on confidentiality, integrity, and availability - though CVSS rates attack complexity as high, indicating non-trivial conditions are required. No public exploit identified at time of analysis. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-39576 | Unauthenticated PHP Object Injection in the SingleMalt WordPress theme (versions up to and including 1.5) allows remote attackers to deserialize attacker-controlled data, which can lead to compromise of confidentiality, integrity, and availability of affected WordPress sites. The flaw is exploitable without authentication or user interaction but has high attack complexity per its CVSS vector, and no public exploit identified at time of analysis. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-42382 | Unauthenticated Local File Inclusion in the Audrey WordPress theme (elated-themes) affects all versions up to and including 1.5, letting remote attackers coerce the PHP application into including arbitrary files. Because CWE-98 covers PHP file-inclusion flaws, a successful include can leak sensitive files (wp-config.php, credentials) and, where remote or attacker-controlled content is includable, escalate to code execution. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, though the network-reachable, unauthenticated nature (CVSS 8.1) makes it a meaningful patching priority for sites running this theme. | HIGH | 8.1 | 0.3% | 40 |
No patch
|