# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2023-25999.md)
  `CVE-2023-25999` · CVE record: snstheme BodyCenter - Gym, Fitness WooCommerce WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Fitrush <= 1.3.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2023-26005.md)
  `CVE-2023-26005` · CVE record: BZOTheme Fitrush · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Nitan theme <= 2.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-24768.md)
  `CVE-2025-24768` · CVE record: snstheme Nitan · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress CraftXtore theme <= 1.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-24770.md)
  `CVE-2025-24770` · CVE record: BZOTheme CraftXtore · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Lab Theme <= 1.0.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-26592.md)
  `CVE-2025-26592` · CVE record: axiomthemes Lab · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Petito theme < 1.6.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-27362.md)
  `CVE-2025-27362` · CVE record: BZOTheme Petito · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress GiftXtore theme < 1.7.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-28888.md)
  `CVE-2025-28888` · CVE record: BZOTheme GiftXtore · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Avaz theme <= 2.8 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-28944.md)
  `CVE-2025-28944` · CVE record: snstheme Avaz · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-28945.md)
  `CVE-2025-28945` · CVE record: snstheme Valen - Sport, Fashion WooCommerce WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress SNS Anton theme <= 4.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-28992.md)
  `CVE-2025-28992` · CVE record: snstheme SNS Anton · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Krowd theme < 1.5.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32595.md)
  `CVE-2025-32595` · CVE record: gavias Krowd · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Revo theme <= 4.0.26 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-39476.md)
  `CVE-2025-39476` · CVE record: magentech Revo · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress WP Event Manager plugin <= 3.1.51 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-48125.md)
  `CVE-2025-48125` · CVE record: WP Event Manager WP Event Manager · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-48126.md)
  `CVE-2025-48126` · CVE record: g5theme Essential Real Estate · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Blogbyte theme <= 1.1.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49275.md)
  `CVE-2025-49275` · CVE record: unfoldwp Blogbyte · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Blogmine theme <= 1.1.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49276.md)
  `CVE-2025-49276` · CVE record: unfoldwp Blogmine · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Blogprise theme <= 1.0.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49277.md)
  `CVE-2025-49277` · CVE record: unfoldwp Blogprise · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Blogty theme <= 1.0.11 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49278.md)
  `CVE-2025-49278` · CVE record: unfoldwp Blogty · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Blogvy theme <= 1.0.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49279.md)
  `CVE-2025-49279` · CVE record: unfoldwp Blogvy · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Magty theme <= 1.0.6 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49280.md)
  `CVE-2025-49280` · CVE record: unfoldwp Magty · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Magways theme <= 1.2.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49281.md)
  `CVE-2025-49281` · CVE record: unfoldwp Magways · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress Magze theme <= 1.0.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49282.md)
  `CVE-2025-49282` · CVE record: unfoldwp Magze · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2025 · Tags: File inclusion
- [WordPress AI Mortgage Calculator <= 1.0.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2023-25995.md)
  `CVE-2023-25995` · CVE record: choicehomemortgage AI Mortgage Calculator · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2025 · Tags: File inclusion
- [WordPress External Store for Shopify plugin <= 1.5.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-30999.md)
  `CVE-2025-30999` · CVE record: Fahad Mahmood External Store for Shopify · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2025 · Tags: File inclusion
- [WordPress BRW plugin <= 1.8.6 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49313.md)
  `CVE-2025-49313` · CVE record: ovatheme BRW · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2025 · Tags: File inclusion
- [WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49308.md)
  `CVE-2025-49308` · CVE record: WP Travel Engine WP Travel Engine · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2025 · Tags: File inclusion
- [WordPress WP Multilang plugin <= 2.4.19 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49307.md)
  `CVE-2025-49307` · CVE record: Magazine3 WP Multilang · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2025 · Tags: File inclusion
- [WordPress Motors - Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-47586.md)
  `CVE-2025-47586` · CVE record: StylemixThemes Motors - Events · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2025 · Tags: File inclusion
- [A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate the "language" cookie to include arbitrary…](https://agentprime.io/advisories/CVE-2024-40112.md)
  `CVE-2024-40112` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: File inclusion
- [WordPress Capie theme <= 1.0.40 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-31060.md)
  `CVE-2025-31060` · CVE record: ApusTheme Capie · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Vizeon theme < 1.2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-31064.md)
  `CVE-2025-31064` · CVE record: gavias Vizeon - Business Consulting · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress La Boom <= 2.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-31632.md)
  `CVE-2025-31632` · CVE record: SpyroPress La Boom · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Kiamo - Responsive Business Service WordPress Theme <= 1.3.3 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-31633.md)
  `CVE-2025-31633` · CVE record: gavias Kiamo - Responsive Business Service WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Enzio - Responsive Business WordPress Theme theme < 1.2.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-31912.md)
  `CVE-2025-31912` · CVE record: gavias Enzio - Responsive Business WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Ogami theme <= 1.53 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-31913.md)
  `CVE-2025-31913` · CVE record: ApusTheme Ogami · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Butcher theme <= 2.40 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32286.md)
  `CVE-2025-32286` · CVE record: ApusTheme Butcher · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Yozi theme <= 2.0.63 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32289.md)
  `CVE-2025-32289` · CVE record: ApusTheme Yozi · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Oxpitan theme <= 1.3.5 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32294.md)
  `CVE-2025-32294` · CVE record: gavias Oxpitan · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Winnex theme <= 1.3.2 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32302.md)
  `CVE-2025-32302` · CVE record: gavias Winnex · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Healsoul theme <= 2.2.3 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32309.md)
  `CVE-2025-32309` · CVE record: ThemeMove Healsoul · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Backpack Traveler theme <= 2.10.2 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-39490.md)
  `CVE-2025-39490` · CVE record: Mikado-Themes Backpack Traveler · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Wilmër theme < 3.4.2 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-39494.md)
  `CVE-2025-39494` · CVE record: Mikado-Themes Wilmër · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Nasa Core Plugin <= 6.3.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39506.md)
  `CVE-2025-39506` · CVE record: NasaTheme Nasa Core · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Ads Pro plugin <= 4.89 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-46444.md)
  `CVE-2025-46444` · CVE record: scripteo Ads Pro · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-46454.md)
  `CVE-2025-46454` · CVE record: svil4ok Meta Keywords & Description · CVSS 7.5 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Fable Extra plugin <= 1.0.6 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-46468.md)
  `CVE-2025-46468` · CVE record: WPFable Fable Extra · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress SEUR Oficial plugin <= 2.2.23 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-46474.md)
  `CVE-2025-46474` · CVE record: SEUR OFICIAL SEUR Oficial · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress WP Job Portal plugin <= 2.3.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-47438.md)
  `CVE-2025-47438` · CVE record: wpjobportal WP Job Portal · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47453.md)
  `CVE-2025-47453` · CVE record: Xylus Themes WP Smart Import · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47670.md)
  `CVE-2025-47670` · CVE record: miniOrange WordPress Social Login and Register · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47672.md)
  `CVE-2025-47672` · CVE record: miniOrange miniOrange Discord Integration · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-48292.md)
  `CVE-2025-48292` · CVE record: GoodLayers Tourmaster · CVSS 8.1 High · Not analysed yet · Published 23 May 2025 · Tags: File inclusion
- [Local File Inclusion vulnerability in Vasco v3.14and before allows a remote attacker to obtain sensitive information via help menu.](https://agentprime.io/advisories/CVE-2025-25539.md)
  `CVE-2025-25539` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 21 May 2025 · Tags: File inclusion
- [WordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32925.md)
  `CVE-2025-32925` · CVE record: FantasticPlugins SUMO Reward Points · CVSS 8.3 High · Not analysed yet · Published 19 May 2025 · Tags: File inclusion
- [WordPress WPAMS plugin <= 44.0 - Local File Inclusion to Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2025-39406.md)
  `CVE-2025-39406` · CVE record: mojoomla WPAMS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2025 · Tags: File inclusion
- [WordPress WhatsApp Click to Chat Plugin for WordPress plugin <= 2.2.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39411.md)
  `CVE-2025-39411` · CVE record: Indie_Plugins WhatsApp Click to Chat Plugin for WordPress · CVSS 7.5 High · Not analysed yet · Published 19 May 2025 · Tags: File inclusion
- [WordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39458.md)
  `CVE-2025-39458` · CVE record: Mikado-Themes Foton · CVSS 8.1 High · Not analysed yet · Published 19 May 2025 · Tags: File inclusion
- [WordPress Grip theme <= 1.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-26735.md)
  `CVE-2025-26735` · CVE record: Candid themes Grip · CVSS 7.5 High · Not analysed yet · Published 19 May 2025 · Tags: File inclusion
- [WordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39396.md)
  `CVE-2025-39396` · CVE record: Crocoblock JetReviews · CVSS 7.5 High · Not analysed yet · Published 19 May 2025 · Tags: File inclusion
- [WordPress Product Category Slider for WooCommerce plugin <= 4.3.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-39364.md)
  `CVE-2025-39364` · CVE record: PluginEver Product Category Slider for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 19 May 2025 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI1LTA1LTE5VDE2OjI4OjMwLjc1MDAwMFoiLCJDVkUtMjAyNS0zOTM2NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI1LTA2LTEwVDEyOjQ0OjMyLjI1NzAwMFoiLCJDVkUtMjAyNS00OTQ1NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI1LTA2LTEwVDEyOjQ0OjMyLjI1NzAwMFoiLCJDVkUtMjAyNS00OTQ1NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.