4
CVEs
0
Critical
4
High
0
KEV
0
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (27)
PHP
23
Wordpress Theme
20
Wordpress Plugin
6
Luxedrive
2
Mikado Core
2
Belfort
1
Techlink
1
Ch Teau
1
D R
1
Multioffice
1
Ashtanga
1
St L
1
Zoya
1
Emaurri
1
Curly Core
1
Kastell
1
Chapterone
1
Rosebud
1
Amfissa
1
Halstein
1
Easymeals
1
Deston
1
Foton Core
1
Esm E
1
Shiftup
1
Biagiotti Core
1
Verdure Core
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78562 | Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-66656 | Local File Inclusion in the Foton Core WordPress plugin (versions ≤ 1.1.1, developed by Mikado Themes) enables unauthenticated remote attackers to supply attacker-controlled file paths to PHP include/require functions, potentially exposing sensitive server files such as wp-config.php or enabling remote code execution via log-poisoning techniques. The CVSS vector confirms unauthenticated network-level access (AV:N/PR:N) with high confidentiality, integrity, and availability impact, though the AC:H rating signals that specific conditions must align for successful exploitation. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole disclosure source. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-66657 | Unauthenticated Local File Inclusion (LFI) in the Biagiotti Core WordPress plugin versions up to and including 2.1.1 allows network-accessible attackers to include arbitrary local files on the server without any credentials. The CVSS 8.1 score with full C/I/A impact ratings reflects the potential to chain LFI into remote code execution via techniques such as log poisoning or session file inclusion, not merely passive file disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H metric signals that exploitation requires specific server-side preconditions to achieve full impact. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-57792 | Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met. | HIGH | 7.5 | 0.5% | 38 |
No patch
|