AncoraThemes has 6 CVEs on record between 2025 and 2026. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 9.8 (critical), with 4 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-502 (4). Most affected products: CleanSkin (2), Anesta (1), Drone Media (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.8
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-78533Critical· 9.8Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.54CVE-2026-66567Critical· 9.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.54CVE-2026-66482Critical· 9.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.54CVE-2026-42723Critical· 9.8Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.54CVE-2026-42724High· 8.1Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.45
AncoraThemes vulnerabilities
CVEs affecting AncoraThemes, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-78533Critical· 9.8Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
CVE-2026-66567Critical· 9.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
CVE-2026-66482Critical· 9.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
CVE-2026-42724High· 8.1Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
CVE-2026-42723Critical· 9.8Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVE-2025-58885High· 8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <…
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <…