Inactive themes still sit on disk. Old theme files can contain known vulnerabilities even when they are not the active theme.
- Go to Appearance → Themes.
- Keep your active theme and, ideally, one default WordPress theme for recovery.
- Delete themes you do not use.
If a theme has not been updated for a long time, switch to a maintained theme before you rely on it again.
Related: Theme updates.
