12
CVEs
0
Critical
11
High
0
KEV
0
PoC
11
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
11
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (10)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-48193 | Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-48194 | Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-62092 | Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-62094 | Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-62096 | Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-62099 | Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-62115 | Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-62091 | Reflected cross-site scripting in the Armania WordPress theme by KuteThemes, affecting all versions through 1.4.8, allows unauthenticated remote attackers to execute arbitrary script in a victim's browser session if they are induced to open a crafted link. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the scope change reflecting that the injected script runs in the context of the affected WordPress site rather than the attacker's origin; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The practical impact is escalation of the attacker's footprint within the victim's session - most severe when the tricked user is an authenticated administrator - but the attack depends entirely on successful social engineering and does not alter server-side state. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-62093 | Reflected cross-site scripting in the TechOne WordPress theme by Kutethemes, affecting all versions up to and including 3.0.3, lets an unauthenticated attacker run arbitrary JavaScript in a site visitor's browser by luring that visitor to a crafted URL that carries the payload into an unsanitized, reflected input. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment); because the payload is reflected rather than stored, the mandatory victim interaction is the key limiting factor and no server-side foothold is obtained. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue was reported by Patchstack. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-62095 | Reflected cross-site scripting in the Biolife WordPress theme (versions up to and including 3.2.3) allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by luring them into clicking a crafted link containing a malicious payload. The vulnerability is network-reachable with low attack complexity but requires user interaction (UI:R) and crosses a scope boundary (S:C), resulting in limited confidentiality and integrity impact (C:L/I:L). No public exploit code or active exploitation has been identified at the time of analysis. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-62100 | Reflected cross-site scripting in the KuteShop WordPress theme (versions 4.2.9 and earlier) lets remote, unauthenticated attackers inject arbitrary script into a page that executes in a victim's browser once that victim clicks a crafted URL. The attack requires user interaction (UI:R) and a site running the vulnerable theme version, which limits automation; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided. Impact scales with the victim's privileges, since a script executing in an administrator's session can be leveraged for session theft or privileged actions, which is why the flaw carries a CVSS 3.1 base score of 7.1. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-62098 | Unauthenticated content injection in the Kutethemes 'Boutique' WordPress theme at version 2.3.3 and earlier lets remote attackers reach a shortcode-handling path and inject arbitrary content into affected sites. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), so any internet-facing WordPress installation with this commercial theme active is exposed by default; the attack surface is bounded to sites running this specific theme. Impact is assessed as limited content injection and partial data exposure (C:L/I:L/A:N) rather than server compromise, and no public exploit code has been identified at time of analysis, so the practical risk is concentrated in unpatched, theme-deployed sites. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|