File and Path Handling

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' ParameterCVE-2026-17604themeum · CVSS 4.9 · 1.2% likely

   CWE-22

2. Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)CVE-2026-15601themeum · CVSS 4.9 · 1.1% likely

   CWE-22

3. Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' ParameterCVE-2026-15457themeum · CVSS 4.9 · 1.1% likely

   CWE-22

4. Tutor LMS < 1.8.8 - Authenticated Local File InclusionCVE-2021-24242Themeum · 0.8% likely

   CWE-22

5. WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerabilityCVE-2024-37266Themeum · CVSS 4.9 · 0.6% likely

   CWE-22

6. WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerabilityCVE-2024-43955Themeum · CVSS 10 · 0.6% likely

   CWE-22

7. Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIPCVE-2026-8073themeum · CVSS 7.5 · 0.6% likely

   CWE-23

8. WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerabilityCVE-2026-65436Themeum · CVSS 6.8 · 0.5% likely

   CWE-22

9. WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerabilityCVE-2026-22330Themeum · CVSS 8.1 · 0.4% likely

   CWE-98

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.