7
CVEs
0
Critical
7
High
0
KEV
0
PoC
5
Unpatched C/H
28.6%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
7
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (20)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-28151 | Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 40 |
|
| CVE-2026-28152 | Local File Inclusion in the Tonda Core WordPress plugin (all versions prior to 2.6) exposes unauthenticated remote attackers to arbitrary local-file disclosure and, under secondary conditions, potential remote code execution on the host server. Reported by Patchstack and registered under ENISA EUVD-2026-64791, the flaw carries a CVSS 3.1 score of 8.1 with full C/I/A impact and no authentication requirement. A vendor-released patch is available at version 2.6; no confirmed active exploitation or public exploit code has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 40 |
|
| CVE-2026-57802 | Local File Inclusion in the Select-Themes "Struktur" WordPress theme (all versions up to and including 2.5.1) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive content such as wp-config.php credentials and, under the right conditions, escalating to code execution. Tracked as CVE-2026-57802 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS vector's PR:L indicates authentication is required and AC:H reflects non-trivial exploitation preconditions. | HIGH | 7.5 | 0.5% | 38 |
No patch
|
| CVE-2026-57803 | Local File Inclusion in the Select-Themes Struktur Core WordPress plugin (all versions up to and including 2.5.1) lets an authenticated low-privileged user coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive server-side content such as wp-config.php credentials. Reported by Patchstack and classified under CWE-98 (PHP Remote File Inclusion), the flaw carries a CVSS 3.1 score of 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. Depending on server configuration, LFI of attacker-influenced content (e.g., poisoned logs or uploaded files) can escalate to PHP code execution. | HIGH | 7.5 | 0.5% | 38 |
No patch
|
| CVE-2026-57801 | PHP Local File Inclusion in the Select-Themes SetSail WordPress theme (versions up to and including 2.1) allows an authenticated attacker to coerce the application into including local files via improper control of a filename in an include/require statement. Successful exploitation can disclose sensitive files (e.g., wp-config.php) and, depending on server conditions, escalate to code execution through log poisoning or PHP wrapper abuse. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing. | HIGH | 7.5 | 0.5% | 38 |
No patch
|
| CVE-2026-57805 | Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 7.5 | 0.5% | 38 |
No patch
|
| CVE-2026-65477 | Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity. | HIGH | 7.5 | 0.3% | 38 |
No patch
|