Scape Vulnerabilities

The Scape - Multipurpose WordPress theme theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to 1.5.16 (exclusive). This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code exec...

CVSS:

9.1

Affected:

up to 1.5.16

Fixed in:

1.5.16

Disclosed:

Mar 20, 2026

CVE-2026-31913 on NVD →

The Scape theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.5.13 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an add...

CVSS:

8.1

Affected:

up to 1.5.13

Fix:

No patched version reported

Disclosed:

Sep 7, 2025

CVE-2025-60213 on NVD →