4
CVEs
2
Critical
1
High
0
KEV
0
PoC
2
Unpatched C/H
25.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
1
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (30)
PHP
67
Wordpress Theme
65
Wordpress Plugin
4
Addons
3
Puzzles
3
Booked
2
Abelle
2
Themerex Addons
2
Modernee
1
Wellspring Water Filter Systems
1
Buisson
1
Prolingua
1
Wineshop
1
Choreo
1
Nelson
1
Ozeum Museum
1
Gunslinger
1
Kelly Young
1
Piqes Creative Startup Agency Wordpress Theme
1
Savejulia Personal Fundraising Campaign
1
Tediss Soft Play Area Cafe Child Care Center
1
Resurs
1
Pixefy
1
Gridiron
1
Bugster Pests Control
1
Nexio
1
Skydiving And Flying Company
1
Kratz Digital Agency
1
Copypress
1
Nazareth Church
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-65573 | Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-62105 | Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2026-57746 | Broken access control in the Booked WordPress appointment-scheduling plugin (versions <= 3.0.0, by ThemeRex) lets low-privileged authenticated users (Subscriber role) reach functionality or data they should not, resulting in high confidentiality exposure and limited integrity impact per the CVSS vector. The flaw stems from missing authorization checks (CWE-862) on plugin actions, so any registered site user can abuse it. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the issue was reported through Patchstack. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-57747 | Unauthenticated CSRF in Booked WordPress plugin (versions <= 3.0.0) enables remote attackers to trigger availability-impacting actions against authenticated WordPress users without their consent. The CVSS vector (C:N/I:N/A:H) indicates this CSRF leads to a destructive availability outcome - likely deletion or corruption of booking/scheduling data - rather than data theft or code execution. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and no required privileges for staging the attack make social-engineering delivery straightforward. | MEDIUM | 6.5 | 0.1% | 32 |
No patch
|