8
CVEs
3
Critical
2
High
0
KEV
0
PoC
5
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
2
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (15)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-57770 | PHP Object Injection in the ThemeGoods Grand Photography WordPress theme (all versions up to and including 5.7.8) lets remote attackers deliver crafted serialized data to an unsafe unserialize() sink, potentially achieving code execution, file operations, or SQL injection through POP gadget chains. The CVSS 9.8 rating reflects unauthenticated network exploitation (PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2025-15689 | Privilege escalation in the ThemeGoods Capella WordPress theme (versions up to and including 2.5.5) allows unauthenticated remote attackers to gain elevated privileges within a WordPress site, per a CVSS 3.1 base score of 9.8. Because the flaw requires no authentication and no user interaction, an attacker can leverage it directly over the network to compromise site integrity, confidentiality, and availability. There is no public exploit identified at time of analysis and no CISA KEV listing, but the maximal CVSS and unauthenticated nature make it a high-priority patching target. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2025-15688 | Unauthenticated SQL injection in the ThemeGoods 'Capella' WordPress theme (versions 2.5.5 and earlier) lets remote attackers inject arbitrary SQL through an unsanitized parameter, exposing backend database contents including the wp_users table. Reported by Patchstack and rated CVSS 9.3 with a scope change, the flaw needs no authentication or user interaction; no public exploit code and no active exploitation have been reported at time of analysis. | CRITICAL | 9.3 | 0.3% | 46 |
No patch
|
| CVE-2025-69152 | Reflected/stored Cross-Site Scripting in the Artale Wedding Photography WordPress theme (versions 2.2.2 and earlier) lets unauthenticated remote attackers inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or load a poisoned page. Reported by Patchstack and rated CVSS 7.1 with a scope change, it primarily threatens site visitors and administrators through session/context theft rather than direct server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57769 | Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2025-53999 | Broken access control in the Altair WordPress theme (ThemeGoods) through version 5.2.2 permits unauthenticated remote attackers to invoke restricted functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any internet-reachable WordPress installation running the affected theme is exposed. Impact is bounded to partial integrity and availability degradation (C:N/I:L/A:L); no public exploit code and no CISA KEV listing have been identified at time of analysis. | MEDIUM | 6.5 | 0.2% | 32 |
No patch
|
| CVE-2026-66652 | Cross-Site Request Forgery in ThemeGoods Grand Tour WordPress theme (versions through 5.5.1) allows unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated administrators or editors by tricking them into visiting a crafted page. The flaw stems from missing or insufficient nonce validation on one or more theme-level AJAX or form-handling endpoints. No public exploit code or active exploitation has been confirmed; this is a Patchstack disclosure with CVSS 5.4 (Medium). | MEDIUM | 5.4 | 0.1% | 27 |
No patch
|
| CVE-2026-65487 | Broken access control in the Photography WordPress theme by ThemeGoods (versions ≤ 7.7.6) permits remote unauthenticated attackers to perform unauthorized integrity-impacting actions without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms trivial network exploitability with low complexity, rooted in CWE-862 (Missing Authorization), where theme logic fails to enforce capability checks before processing sensitive requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 5.3 | 0.2% | 26 |
No patch
|