The4 vulnerabilities

Products

• Kalles Addons 2
• Kalles 1
• Molla 1

Latest The4 CVEs

Newest publication first

1. CVE-2026-62076 WordPress Kalles theme <= 1.1.7.1 - PHP Object Injection vulnerability

   Published 2026-10-10

   Critical·CVSS 9.8 EPSS 0.38%

   Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

2. CVE-2026-81778 WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

   Published 2026-08-31

   Medium·CVSS 6.5 EPSS 0.22%

   Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions.

3. CVE-2026-73389 WordPress Kalles Addons plugin <= 1.0.6 - PHP Object Injection vulnerability

   Published 2026-08-19

   Critical·CVSS 9.8 EPSS 0.56%

   Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.

4. CVE-2025-60070 WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability

   Published 2025-12-18

   Medium·CVSS 6.5 EPSS 0.23%

   Improper Control of Generation of Code ('Code Injection') vulnerability in The4 Molla molla allows Code Injection.This issue affects Molla: from n/a through <= 1.5.13.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.