# File inclusion. A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [SuiteCRM: LFI to RCE via AOW_WorkFlow](https://agentprime.io/advisories/CVE-2026-71550.md) `CVE-2026-71550` · CVE record: SuiteCRM SuiteCRM · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: File inclusion - [Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php](https://agentprime.io/advisories/CVE-2026-73695.md) `CVE-2026-73695` · CVE record: Control Web Panel Control Web Panel · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: File inclusion - [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62121.md) `CVE-2026-62121` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: File inclusion - [DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php](https://agentprime.io/advisories/CVE-2010-20125.md) `CVE-2010-20125` · CVE record: DedeCMS DedeCMS · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: File inclusion - [Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters](https://agentprime.io/advisories/CVE-2026-110185.md) `CVE-2026-110185` · CVE record: bitpressadmin Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: File inclusion - [C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php](https://agentprime.io/advisories/CVE-2014-125137.md) `CVE-2014-125137` · CVE record: C97net qEngine CMS and 2 more · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: File inclusion - [WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-112850.md) `CVE-2026-112850` · CVE record: AncoraThemes Your Dress · CVSS 8.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: File inclusion - [WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-112832.md) `CVE-2026-112832` · CVE record: CozyThemes Rootblox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: File inclusion - [Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter](https://agentprime.io/advisories/CVE-2017-20289.md) `CVE-2017-20289` · CVE record: Broadstreet Ad Widget · CVSS 7.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: File inclusion - [WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-112820.md) `CVE-2026-112820` · CVE record: Elated-Themes Academist Core · CVSS 8.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: File inclusion - [Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php](https://agentprime.io/advisories/CVE-2016-20101.md) `CVE-2016-20101` · CVE record: Pedro Marcelo Issuu Panel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: File inclusion - [ArmorX Global Technology｜ArmorX Spam - Local File Inclusion](https://agentprime.io/advisories/CVE-2026-113402.md) `CVE-2026-113402` · CVE record: ArmorX Global Technology ArmorX Spam · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: File inclusion - [WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-111829.md) `CVE-2026-111829` · CVE record: WP Mailster WP Mailster · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: File inclusion - [YOURLS: Unauthenticated File Inclusion](https://agentprime.io/advisories/GHSA-f8ff-652m-j5rx.md) `GHSA-f8ff-652m-j5rx`, `CVE-2026-62858`, `PKSA-grvh-n5s5-5dmb` · Packagist `yourls/yourls`: affected `<1.10.5`, fixed in `1.10.5` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: File inclusion - [Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '\\_type' Parameter](https://agentprime.io/advisories/CVE-2026-104909.md) `CVE-2026-104909` · CVE record: kitae-park Mang Board · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: File inclusion - [LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes](https://agentprime.io/advisories/CVE-2026-110284.md) `CVE-2026-110284` · CVE record: lifterlms LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: File inclusion - [ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter](https://agentprime.io/advisories/CVE-2026-103367.md) `CVE-2026-103367` · CVE record: wpdesk ShopMagic – email automation for WordPress · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: File inclusion - [BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value](https://agentprime.io/advisories/CVE-2026-104995.md) `CVE-2026-104995` · CVE record: dontdream BP Profile Search · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: File inclusion - [WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66566.md) `CVE-2026-66566` · CVE record: Elated-Themes Ambient · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62115.md) `CVE-2026-62115` · CVE record: kutethemes KuteShop · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62099.md) `CVE-2026-62099` · CVE record: kutethemes Boutique · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62096.md) `CVE-2026-62096` · CVE record: kutethemes Biolife · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62094.md) `CVE-2026-62094` · CVE record: kutethemes TechOne · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62092.md) `CVE-2026-62092` · CVE record: kutethemes Armania · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62075.md) `CVE-2026-62075` · CVE record: Mymoun Backhoe · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62074.md) `CVE-2026-62074` · CVE record: ThemeREX Ozeum · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62070.md) `CVE-2026-62070` · CVE record: CKThemes Flipmart · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62069.md) `CVE-2026-62069` · CVE record: CocoBasic Fabius · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62068.md) `CVE-2026-62068` · CVE record: CocoBasic Teoro · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62067.md) `CVE-2026-62067` · CVE record: CocoBasic Kaven · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62066.md) `CVE-2026-62066` · CVE record: CocoBasic Volos · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62065.md) `CVE-2026-62065` · CVE record: CocoBasic Cardea · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62032.md) `CVE-2026-62032` · CVE record: Designinvento DirectoryPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-62020.md) `CVE-2026-62020` · CVE record: Mikado-Themes TouchUp · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-48194.md) `CVE-2026-48194` · CVE record: kutethemes DukaMarket · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-48193.md) `CVE-2026-48193` · CVE record: kutethemes Uminex · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-42777.md) `CVE-2026-42777` · CVE record: Edge-Themes Aalto · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-42724.md) `CVE-2026-42724` · CVE record: AncoraThemes CleanSkin · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-42704.md) `CVE-2026-42704` · CVE record: axiomthemes Kids Care · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter](https://agentprime.io/advisories/CVE-2026-104899.md) `CVE-2026-104899` · CVE record: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: File inclusion - [WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-94067.md) `CVE-2026-94067` · CVE record: Fuelthemes The Voux · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: File inclusion - [WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-94062.md) `CVE-2026-94062` · CVE record: Fuelthemes Werkstatt · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: File inclusion - [WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting](https://agentprime.io/advisories/CVE-2026-75028.md) `CVE-2026-75028` · CVE record: arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2026 · Tags: File inclusion - [SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter](https://agentprime.io/advisories/CVE-2026-92174.md) `CVE-2026-92174` · CVE record: gpriday SiteOrigin Widgets Bundle · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: File inclusion - [GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field](https://agentprime.io/advisories/CVE-2026-71426.md) `CVE-2026-71426` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal, File inclusion - [WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-96837.md) `CVE-2026-96837` · CVE record: Brainstorm Force CartFlows · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: File inclusion - [Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter](https://agentprime.io/advisories/CVE-2026-89294.md) `CVE-2026-89294` · CVE record: croixhaug Simply Schedule Appointments · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: File inclusion - [InvoicePlane: Missing CSRF Protection on State-Changing delete Actions](https://agentprime.io/advisories/CVE-2026-49850.md) `CVE-2026-49850` · CVE record: InvoicePlane InvoicePlane · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, File inclusion - [InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier](https://agentprime.io/advisories/CVE-2026-50547.md) `CVE-2026-50547` · CVE record: InvoicePlane InvoicePlane · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, File inclusion - [InvoicePlane: Remote Code Execution via Writable Templates Directory](https://agentprime.io/advisories/CVE-2026-39353.md) `CVE-2026-39353` · CVE record: InvoicePlane InvoicePlane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: File inclusion, Broken access control, CWE-693 - [WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter](https://agentprime.io/advisories/CVE-2026-13456.md) `CVE-2026-13456` · CVE record: flippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: File inclusion - [Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter](https://agentprime.io/advisories/CVE-2026-12227.md) `CVE-2026-12227` · CVE record: visualcomposer Visual Composer Website Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: File inclusion - [PHP file inclusion in WordPress](https://agentprime.io/advisories/CVE-2026-87902.md) `CVE-2026-87902` · CVE record: WordPress WordPress · CVSS 8.1 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.96 · Not analysed yet · Published 22 Sept 2026 · Tags: File inclusion - [WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-9231.md) `CVE-2026-9231` · CVE record: wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: File inclusion - [HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX](https://agentprime.io/advisories/CVE-2026-92969.md) `CVE-2026-92969` · CVE record: realmag777 HUSKY – Products Filter for WooCommerce Professional · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: File inclusion - [All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes](https://agentprime.io/advisories/CVE-2026-88994.md) `CVE-2026-88994` · CVE record: Unknown All Bootstrap Blocks · CVSS 6.6 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: File inclusion - [Local File Inclusion in /index.php/ajax/save_iodd_parameters](https://agentprime.io/advisories/CVE-2026-27556.md) `CVE-2026-27556` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: File inclusion - [Local File Inclusion in /index.php/ajax/get_iodd_port_info](https://agentprime.io/advisories/CVE-2026-27555.md) `CVE-2026-27555` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: File inclusion - [GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2026-85200.md) `CVE-2026-85200` · CVE record: ninjew GEO my WP · CVSS 7.5 High · Not analysed yet · Published 12 Sept 2026 · Tags: File inclusion - [MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher](https://agentprime.io/advisories/CVE-2026-87927.md) `CVE-2026-87927` · CVE record: MaxSite MaxSite CMS · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2026 · Tags: File inclusion Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .