# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Bimber - Viral Magazine WordPress Theme theme <= 9.2.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-47576.md)
  `CVE-2025-47576` · CVE record: Bringthepixel Bimber - Viral Magazine WordPress Theme · CVSS 8.8 High · Not analysed yet · Published 19 May 2025 · Tags: File inclusion
- [WordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39507.md)
  `CVE-2025-39507` · CVE record: NasaTheme Nasa Core · CVSS 7.5 High · Not analysed yet · Published 16 May 2025 · Tags: File inclusion
- [WordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-47693.md)
  `CVE-2025-47693` · CVE record: roninwp FAT Services Booking · CVSS 7.5 High · Not analysed yet · Published 16 May 2025 · Tags: File inclusion
- [WordPress Mortgage Calculator Estatik plugin <= 2.0.12 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-48136.md)
  `CVE-2025-48136` · CVE record: Estatik Mortgage Calculator Estatik · CVSS 7.5 High · Not analysed yet · Published 16 May 2025 · Tags: File inclusion
- [WordPress WP-Recall <= 16.26.14 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47653.md)
  `CVE-2025-47653` · CVE record: tggfref WP-Recall · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47531.md)
  `CVE-2025-47531` · CVE record: Xylus Themes XT Event Widget for Social Events · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress Display Eventbrite Events plugin < 6.3 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47510.md)
  `CVE-2025-47510` · CVE record: fullworks Display Eventbrite Events · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress GamiPress plugin <= 7.3.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47508.md)
  `CVE-2025-47508` · CVE record: Ruben Garcia GamiPress · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress Hotel Booking plugin <= 3.6 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47498.md)
  `CVE-2025-47498` · CVE record: nicdark Hotel Booking · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47496.md)
  `CVE-2025-47496` · CVE record: PublishPress PublishPress Authors · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress EventON plugin <= 2.4.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47494.md)
  `CVE-2025-47494` · CVE record: Ashan Perera EventON · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress WPAdverts plugin <= 2.2.2 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47440.md)
  `CVE-2025-47440` · CVE record: Greg Winiarski WPAdverts · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [WordPress Download Monitor plugin <= 5.0.22 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47439.md)
  `CVE-2025-47439` · CVE record: WP Chill Download Monitor · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: File inclusion
- [Edumall <= 4.2.4 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2025-2101.md)
  `CVE-2025-2101` · CVE record: ThemeMove EduMall - Professional LMS Education Center WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 26 Apr 2025 · Tags: File inclusion
- [WordPress Arrival theme <= 1.4.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32921.md)
  `CVE-2025-32921` · CVE record: wpoperations Arrival · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39359.md)
  `CVE-2025-39359` · CVE record: codeworkweb CWW Portfolio · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Grace Mag theme <= 1.1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39360.md)
  `CVE-2025-39360` · CVE record: everestthemes Grace Mag · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39378.md)
  `CVE-2025-39378` · CVE record: Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Capturly plugin <= 2.0.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39379.md)
  `CVE-2025-39379` · CVE record: Capturly Capturly · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Xews Lite plugin <= 1.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39383.md)
  `CVE-2025-39383` · CVE record: codeworkweb Xews Lite · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Product Lister for eBay plugin <= 2.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39384.md)
  `CVE-2025-39384` · CVE record: cedcommerce Product Lister for eBay · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Opstore theme <= 1.4.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39387.md)
  `CVE-2025-39387` · CVE record: wpoperations Opstore · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Checkout Field Visibility for WooCommerce plugin <= 1.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39391.md)
  `CVE-2025-39391` · CVE record: zamartz Checkout Field Visibility for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress License For Envato plugin <= 1.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39399.md)
  `CVE-2025-39399` · CVE record: Ashraful Sarkar Naiem License For Envato · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [WordPress Popup Builder plugin <= 1.1.35 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-46230.md)
  `CVE-2025-46230` · CVE record: GhozyLab Popup Builder · CVSS 7.5 High · Not analysed yet · Published 24 Apr 2025 · Tags: File inclusion
- [Local File Inclusion (LFI) leading to sensitive data exposure](https://agentprime.io/advisories/CVE-2025-0632.md)
  `CVE-2025-0632` · CVE record: Formulatrix Rock Maker Web · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2025 · Tags: Path traversal, File inclusion
- [WordPress Ray Enterprise Translation plugin <= 1.7.0 - Local File Inclusion via CSRF Vulnerability](https://agentprime.io/advisories/CVE-2025-31030.md)
  `CVE-2025-31030` · CVE record: Jiro Sasamoto Ray Enterprise Translation · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2025 · Tags: File inclusion
- [WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39526.md)
  `CVE-2025-39526` · CVE record: nicdark Hotel Booking · CVSS 8.1 High · Not analysed yet · Published 17 Apr 2025 · Tags: File inclusion
- [WordPress Széchenyi 2020 Logo <= 1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39429.md)
  `CVE-2025-39429` · CVE record: Földesi, Mihály Széchenyi 2020 Logo · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2025 · Tags: File inclusion
- [WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39452.md)
  `CVE-2025-39452` · CVE record: Arraytics WPCafe · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2025 · Tags: File inclusion
- [WordPress Docket Cache plugin <= 24.07.02 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39461.md)
  `CVE-2025-39461` · CVE record: Nawawi Jamili Docket Cache · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2025 · Tags: File inclusion
- [WordPress Smart Agreements plugin <= 1.0.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39462.md)
  `CVE-2025-39462` · CVE record: teamzt Smart Agreements · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2025 · Tags: File inclusion
- [Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP Program](https://agentprime.io/advisories/CVE-2025-31340.md)
  `CVE-2025-31340` · CVE record: SUNNET Technology Co., Ltd. Wisdom Master Pro · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2025 · Tags: File inclusion
- [WordPress WPCOM Member plugin <= 1.7.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-39570.md)
  `CVE-2025-39570` · CVE record: Lomu WPCOM Member · CVSS 8.8 High · Not analysed yet · Published 16 Apr 2025 · Tags: File inclusion
- [WordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-39584.md)
  `CVE-2025-39584` · CVE record: Arraytics Eventin · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2025 · Tags: File inclusion
- [WordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-39592.md)
  `CVE-2025-39592` · CVE record: WP Shuffle Subscribe to Unlock Lite · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2025 · Tags: File inclusion
- [WordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-27011.md)
  `CVE-2025-27011` · CVE record: magepeopleteam Booking and Rental Manager · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2025 · Tags: File inclusion
- [WordPress Coming Soon, Maintenance Mode plugin <= 1.1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-26894.md)
  `CVE-2025-26894` · CVE record: Mobeen Abdullah Coming Soon, Maintenance Mode · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2025 · Tags: File inclusion
- [WordPress hockeydata LOS plugin <= 1.2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-26889.md)
  `CVE-2025-26889` · CVE record: hockeydata hockeydata LOS · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2025 · Tags: File inclusion
- [WordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32672.md)
  `CVE-2025-32672` · CVE record: g5theme Ultimate Bootstrap Elements for Elementor · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress FAT Cooming Soon plugin <= 1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32663.md)
  `CVE-2025-32663` · CVE record: roninwp FAT Cooming Soon · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress Testimonial Slider and Showcase Pro plugin <= 2.3.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32656.md)
  `CVE-2025-32656` · CVE record: RadiusTheme Testimonial Slider And Showcase Pro · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32654.md)
  `CVE-2025-32654` · CVE record: Stylemix Motors · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32627.md)
  `CVE-2025-32627` · CVE record: JoomSky JS Job Manager · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32614.md)
  `CVE-2025-32614` · CVE record: Ashan Perera EventON · CVSS 8.8 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress Flexi – Guest Submit Plugin <= 4.28 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32589.md)
  `CVE-2025-32589` · CVE record: odude Flexi – Guest Submit · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress Build App Online Plugin <= 1.0.23 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32577.md)
  `CVE-2025-32577` · CVE record: hakeemnala Build App Online · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress IDonate plugin <= 2.1.18 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32519.md)
  `CVE-2025-32519` · CVE record: Foysal Imran IDonate · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-31040.md)
  `CVE-2025-31040` · CVE record: Exthemes WP Food ordering and Restaurant Menu · CVSS 8.1 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress SMTP Service, Email Delivery Solved! — MailHawk plugin <= 1.3.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-31015.md)
  `CVE-2025-31015` · CVE record: Adrian Tobey WordPress SMTP Service, Email Delivery Solved! — MailHawk · CVSS 7.5 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-31014.md)
  `CVE-2025-31014` · CVE record: Hossein Material Dashboard · CVSS 7.5 High · Not analysed yet · Published 11 Apr 2025 · Tags: File inclusion
- [WordPress JetCompareWishlist plugin <= 1.5.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-22279.md)
  `CVE-2025-22279` · CVE record: Crocoblock JetCompareWishlist · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2025 · Tags: File inclusion
- [WordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32160.md)
  `CVE-2025-32160` · CVE record: Ashan Perera EventON · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2025 · Tags: File inclusion
- [WordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32158.md)
  `CVE-2025-32158` · CVE record: Syed Balkhi aThemes Addons for Elementor · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2025 · Tags: File inclusion
- [WordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32668.md)
  `CVE-2025-32668` · CVE record: Rameez Iqbal Real Estate Manager · CVSS 8.1 High · Not analysed yet · Published 10 Apr 2025 · Tags: File inclusion
- [WordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32499.md)
  `CVE-2025-32499` · CVE record: wpWax Logo Showcase Ultimate · CVSS 6.5 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: File inclusion
- [WordPress WP Subscription Forms plugin <= 1.2.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32692.md)
  `CVE-2025-32692` · CVE record: WP Shuffle WP Subscription Forms · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2025 · Tags: File inclusion
- [WordPress Radius Blocks plugin <= 2.2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32159.md)
  `CVE-2025-32159` · CVE record: RadiusTheme Radius Blocks · CVSS 7.5 High · Not analysed yet · Published 4 Apr 2025 · Tags: File inclusion
- [WordPress Sparkle Elementor Kit plugin <= 2.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32157.md)
  `CVE-2025-32157` · CVE record: Jakub Glos Sparkle Elementor Kit · CVSS 7.5 High · Not analysed yet · Published 4 Apr 2025 · Tags: File inclusion
- [WordPress Just Post Preview Widget plugin <= 1.1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32156.md)
  `CVE-2025-32156` · CVE record: Alex Prokopenko / JustCoded Just Post Preview Widget · CVSS 7.5 High · Not analysed yet · Published 4 Apr 2025 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI1LTA0LTA0VDE1OjU4OjQxLjEyNzAwMFoiLCJDVkUtMjAyNS0zMjE1NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI1LTA1LTE5VDE2OjI4OjMwLjc1MDAwMFoiLCJDVkUtMjAyNS0zOTM2NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI1LTA1LTE5VDE2OjI4OjMwLjc1MDAwMFoiLCJDVkUtMjAyNS0zOTM2NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.