Agora — Event & Conference WordPress Theme <= 1.9 - Unauthenticated PHP Object Injection
high
The Agora — Event & Conference WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.9 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If...
- CVSS:
- 8.1
- Affected:
- up to 1.9
- Fix:
- No patched version reported
- Disclosed:
- Aug 6, 2026
CVE-2026-65578 on NVD →
Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes <= 1.18.0 - Unauthenticated Local File Inclusion
high
Multiple themes for WordPress by axiomthemes, ThemeRex, and AncoraThemes are vulnerable to Local File Inclusion in various versions. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to...
- CVSS:
- 8.1
- Affected:
- up to 1.8.0
- Fixed in:
- 1.8.0
- Disclosed:
- Jun 9, 2025
CVE-2025-26592 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database