AncoraThemes has 7 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 9.8 (critical), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-502 (4) and CWE-98 (3). Most affected products: CleanSkin (2), Anesta (1), Drone Media (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.8
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- CleanSkin 2
- Anesta 1
- Drone Media 1
- Qwery 1
- pathfinder 1
- your-dress 1
Worst active — by depth score
CVE-2026-78533Critical· 9.8Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.54CVE-2026-66567Critical· 9.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.54CVE-2026-66482Critical· 9.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.54CVE-2026-42723Critical· 9.8Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.54CVE-2026-112850High· 8.1WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability45
AncoraThemes vulnerabilities
CVEs affecting AncoraThemes, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-112850High· 8.1WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1…
CVE-2026-78533Critical· 9.8Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
CVE-2026-66567Critical· 9.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
CVE-2026-66482Critical· 9.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
CVE-2026-42724High· 8.1Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
CVE-2026-42723Critical· 9.8Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVE-2025-58885High· 8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <…
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <…