21
CVEs
2
Critical
19
High
0
KEV
0
PoC
18
Unpatched C/H
14.3%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
19
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (20)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-32502 | A deserialization of untrusted data vulnerability exists in Select-Themes Borgholm marketing agency theme (WordPress) that allows object injection attacks. The vulnerability affects Borgholm versions prior to 1.6, and attackers can exploit this to inject malicious PHP objects that execute arbitrary code within the WordPress environment. While no CVSS score or EPSS data is currently available, the CWE-502 classification indicates this is a critical deserialization flaw with high exploitation potential; no active KEV or public POC status is documented, but the vulnerability was reported through Patchstack with full advisory details available. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2024-34551 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2024-34552 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm allows PHP Local File Inclusion.6. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.5% | 44 |
No patch
|
| CVE-2024-34554 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Select-Themes Stockholm Core allows PHP Local File Inclusion.4.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.5% | 44 |
No patch
|
| CVE-2026-25457 | A Local File Inclusion (LFI) vulnerability exists in the Select-Themes Mixtape WordPress theme through version 2.1, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling information disclosure and potential remote code execution depending on file accessibility. While no CVSS score or EPSS data is currently available, the LFI classification and PHP nature of the vulnerability indicate moderate to high exploitability with network-based attack vectors. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-25458 | The Select-Themes Moments WordPress theme versions 2.2 and earlier contain a Local File Inclusion (LFI) vulnerability that allows attackers to improperly control filename parameters in PHP include/require statements. An unauthenticated attacker can exploit this vulnerability to read arbitrary files from the affected server, potentially disclosing sensitive configuration files, source code, or other confidential information. While no CVSS score or EPSS data is currently available and no active KEV listing is confirmed, the vulnerability is catalogued by Patchstack and has been assigned EUVD-2026-15740, indicating documented exploitation potential. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-39547 | Local File Inclusion in the Getaway WordPress theme (versions before 1.8) by Select-Themes allows unauthenticated remote attackers to include arbitrary local PHP files via an unsanitized include/require parameter, leading to disclosure of sensitive files and potential code execution. The CWE-98 classification indicates improper control of filename used in PHP include/require, a pattern that frequently chains into RCE when log files, session files, or uploaded media can be referenced. No public exploit identified at time of analysis, and the issue is not in CISA KEV. | HIGH | 8.1 | 0.4% | 40 |
|
| CVE-2026-39567 | Unauthenticated PHP object injection in the Santé WordPress theme through version 1.5.1 allows remote attackers to deserialize attacker-controlled data and potentially achieve remote code execution, data tampering, or denial of service when a suitable POP gadget chain is present. The flaw is reported by Patchstack and tracked as EUVD-2026-37480; no public exploit identified at time of analysis, and the CVSS 8.1 score reflects high attack complexity offset by network reach and no authentication. The Santé theme is a commercial Select Themes product, so exposure is limited to sites that have installed and activated this specific theme. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39580 | PHP Object Injection in the Micdrop WordPress theme versions 1.3.1 and earlier allows remote unauthenticated attackers to trigger insecure deserialization, potentially leading to high impact on confidentiality, integrity, and availability of the underlying site. No public exploit identified at time of analysis, and the CVSS vector reflects high attack complexity, meaning successful exploitation likely depends on the presence of a usable PHP gadget chain in the site's installed plugins or core. The flaw is tracked as CWE-502 (Deserialization of Untrusted Data) and was reported by Patchstack. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-39545 | Unauthenticated PHP Object Injection in the Zermatt WordPress theme versions 1.6.1 and earlier allows remote attackers to deliver malicious serialized PHP objects to a vulnerable unserialize() sink without prior authentication. Successful exploitation can lead to high impact on confidentiality, integrity, and availability when a suitable POP gadget chain is reachable in the WordPress installation. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39573 | Unauthenticated PHP Object Injection affects the Select Themes Mildhill WordPress theme in versions 1.5 and earlier, allowing remote attackers to inject crafted serialized PHP objects that the application deserializes without validation. Successful exploitation can yield high confidentiality, integrity, and availability impact on the underlying WordPress site, typically by chaining the injected object with a POP gadget present in the theme, WordPress core, or another installed plugin. No public exploit identified at time of analysis, and the issue is reported via Patchstack rather than the CISA KEV catalog. | HIGH | 8.1 | 0.4% | 40 |
No patch
|
| CVE-2026-39560 | Unauthenticated PHP object injection in the Select Themes 'Hiroshi' WordPress theme through version 1.5.1 allows remote attackers to supply crafted serialized payloads that are deserialized by the theme, potentially leading to code execution, file manipulation, or data compromise when a suitable PHP magic-method gadget chain is present in the WordPress stack. The flaw is reachable without authentication per the CVSS vector, and no public exploit has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-40752 | Unauthenticated PHP object injection in the Manufaktur Solutions WordPress theme (versions 1.1.1 and earlier) allows remote attackers to deserialize attacker-controlled data, potentially leading to arbitrary code execution, data tampering, or denial of service when a suitable PHP gadget chain is present. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, tempered by AC:H due to dependency on exploitable gadget chains in the WordPress runtime. No public exploit identified at time of analysis and the issue is not listed in CISA KEV. | HIGH | 8.1 | 0.3% | 40 |
No patch
|
| CVE-2026-28151 | Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 40 |
|
| CVE-2026-28152 | Local File Inclusion in the Tonda Core WordPress plugin (all versions prior to 2.6) exposes unauthenticated remote attackers to arbitrary local-file disclosure and, under secondary conditions, potential remote code execution on the host server. Reported by Patchstack and registered under ENISA EUVD-2026-64791, the flaw carries a CVSS 3.1 score of 8.1 with full C/I/A impact and no authentication requirement. A vendor-released patch is available at version 2.6; no confirmed active exploitation or public exploit code has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 40 |
|