11
CVEs
0
Critical
11
High
0
KEV
0
PoC
11
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
11
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (27)
PHP
23
Wordpress Theme
20
Wordpress Plugin
6
Luxedrive
2
Mikado Core
2
Belfort
1
Techlink
1
Ch Teau
1
D R
1
Multioffice
1
Ashtanga
1
St L
1
Zoya
1
Emaurri
1
Curly Core
1
Kastell
1
Chapterone
1
Rosebud
1
Amfissa
1
Halstein
1
Easymeals
1
Deston
1
Foton Core
1
Esm E
1
Shiftup
1
Biagiotti Core
1
Verdure Core
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78562 | Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-66656 | Local File Inclusion in the Foton Core WordPress plugin (versions ≤ 1.1.1, developed by Mikado Themes) enables unauthenticated remote attackers to supply attacker-controlled file paths to PHP include/require functions, potentially exposing sensitive server files such as wp-config.php or enabling remote code execution via log-poisoning techniques. The CVSS vector confirms unauthenticated network-level access (AV:N/PR:N) with high confidentiality, integrity, and availability impact, though the AC:H rating signals that specific conditions must align for successful exploitation. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole disclosure source. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-66657 | Unauthenticated Local File Inclusion (LFI) in the Biagiotti Core WordPress plugin versions up to and including 2.1.1 allows network-accessible attackers to include arbitrary local files on the server without any credentials. The CVSS 8.1 score with full C/I/A impact ratings reflects the potential to chain LFI into remote code execution via techniques such as log poisoning or session file inclusion, not merely passive file disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H metric signals that exploitation requires specific server-side preconditions to achieve full impact. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-39537 | Unauthenticated local file inclusion in the Mikado Core WordPress plugin versions 1.6 and earlier allows remote attackers to include arbitrary local files via crafted HTTP requests, potentially exposing sensitive server contents and enabling code execution. CVSS 8.1 reflects high impact across confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-40731 | Unauthenticated local file inclusion in the Mikado-Themes ChapterOne WordPress theme (versions 1.7 and earlier) allows remote attackers to coerce the PHP application into including arbitrary local files via crafted requests. Successful exploitation can disclose sensitive files such as wp-config.php and, depending on server configuration, lead to PHP code execution by including attacker-influenced content. No public exploit identified at time of analysis, but the vulnerability is publicly cataloged by Patchstack. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-40753 | Unauthenticated PHP Object Injection affects the Mikado-Themes EasyMeals WordPress theme through version 1.5.1, allowing remote attackers to inject crafted serialized objects that are deserialized by vulnerable PHP code paths. Successful exploitation can lead to high-impact compromise of confidentiality, integrity, and availability on the underlying WordPress site, though no public exploit identified at time of analysis. The CVSS 8.1 score reflects high attack complexity, consistent with the typical need for a usable gadget chain in the host WordPress environment. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-40733 | Unauthenticated PHP object injection in the Mikado Themes ShiftUp WordPress theme (versions ≤ 1.3) allows remote attackers to pass attacker-controlled serialized data into a PHP unserialize() sink, potentially triggering gadget chains that can lead to remote code execution, data tampering, or site takeover. CVSS is rated 8.1 with high attack complexity but no privileges or user interaction required, and no public exploit identified at time of analysis. The issue was disclosed via Patchstack. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-40756 | Unauthenticated PHP Object Injection in the Mikado-Themes Zoya WordPress theme versions 1.4 and earlier allows remote attackers to inject crafted serialized objects that are deserialized by the application. Successful exploitation can lead to arbitrary code execution, data tampering, or denial of service depending on the gadget chains present in WordPress core, plugins, or other themes loaded on the site. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. | HIGH | 8.1 | 0.2% | 40 |
No patch
|
| CVE-2026-40757 | Unauthenticated PHP Object Injection in the Mikado-Themes 'Château' WordPress theme (versions ≤ 1.2.1) allows remote attackers to deserialize attacker-controlled data, potentially leading to arbitrary code execution, file manipulation, or full site compromise when a suitable POP gadget chain is present in the WordPress stack. The flaw was disclosed via Patchstack with CVSS 8.1 (high) due to network-reachable, unauthenticated impact across confidentiality, integrity, and availability, though high attack complexity (AC:H) reflects the dependency on a usable gadget chain. No public exploit identified at time of analysis. | HIGH | 8.1 | 0.2% | 40 |
No patch
|
| CVE-2026-52707 | Unauthenticated local file inclusion in the Mikado-Themes Kastell WordPress theme (versions ≤ 2.0) allows remote attackers to traverse directories and read or include arbitrary server-side files, potentially leading to disclosure of sensitive configuration data such as wp-config.php and, depending on PHP configuration, code execution. The flaw is reported via Patchstack with CVSS 8.1 (high) and no public exploit identified at time of analysis. The CWE-35 classification (Path Traversal: '.../...//') points to relative-path manipulation as the root cause. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-57792 | Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met. | HIGH | 7.5 | 0.5% | 38 |
No patch
|