# File inclusion. A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2025-6991.md) `CVE-2025-6991` · CVE record: hogash KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme · CVSS 7.5 High · Not analysed yet · Published 26 Jul 2025 · Tags: File inclusion - [LibreNMS has Authenticated Remote File Inclusion in ajax_form.php that Allows RCE](https://agentprime.io/advisories/GHSA-gq96-8w38-hhj2.md) `GHSA-gq96-8w38-hhj2`, `CVE-2025-54138`, `PKSA-q97j-hw3m-d3vd` · Packagist `librenms/librenms`: affected `<25.7.0`, fixed in `25.7.0` · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2025 · Tags: File inclusion - [Dolibarr has Remote Code Execution Vulnerability (Bypass)](https://agentprime.io/advisories/GHSA-49xw-hw94-fmv2.md) `GHSA-49xw-hw94-fmv2`, `PKSA-3npz-m8nk-z1d7` · Packagist `dolibarr/dolibarr`: affected `<=21.0.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 21 Jul 2025 · Tags: File inclusion - [Access to local file system and its content](https://agentprime.io/advisories/CVE-2025-24937.md) `CVE-2025-24937` · CVE record: Nokia WaveSuite NOC · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2025 · Tags: File inclusion - [Subscribe to Comments <= 2.1.2 - Local File Includion](https://agentprime.io/advisories/CVE-2015-10133.md) `CVE-2015-10133` · CVE record: markjaquith Subscribe to Comments · CVSS 7.2 High · Not analysed yet · Published 19 Jul 2025 · Tags: File inclusion - [WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-54015.md) `CVE-2025-54015` · CVE record: HT Plugins HT Contact Form 7 · CVSS 6.6 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: File inclusion - [WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2025-6746.md) `CVE-2025-6746` · CVE record: xTemos Woodmart · CVSS 8.8 High · Not analysed yet · Published 8 Jul 2025 · Tags: File inclusion - [Widget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion](https://agentprime.io/advisories/CVE-2025-7327.md) `CVE-2025-7327` · CVE record: techlabpro1 Widget for Google Reviews · CVSS 8.8 High · Not analysed yet · Published 8 Jul 2025 · Tags: File inclusion - [WordPress PrivateContent - Mail Actions plugin <= 2.3.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-47627.md) `CVE-2025-47627` · CVE record: LCweb PrivateContent - Mail Actions · CVSS 7.5 High · Not analysed yet · Published 4 Jul 2025 · Tags: File inclusion - [WordPress Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52807.md) `CVE-2025-52807` · CVE record: ApusWP Kossy - Minimalist eCommerce WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 4 Jul 2025 · Tags: File inclusion - [WordPress CMSMasters Content Composer plugin < 2.5.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-4414.md) `CVE-2025-4414` · CVE record: cmsmasters CMSMasters Content Composer · CVSS 8.1 High · Not analysed yet · Published 4 Jul 2025 · Tags: File inclusion - [WordPress Elessi < 6.4.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49070.md) `CVE-2025-49070` · CVE record: NasaTheme Elessi · CVSS 7.5 High · Not analysed yet · Published 4 Jul 2025 · Tags: File inclusion - [Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2025-4380.md) `CVE-2025-4380` · CVE record: scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.43 · Not analysed yet · Published 2 Jul 2025 · Tags: File inclusion - [Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-4689.md) `CVE-2025-4689` · CVE record: scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2025 · Tags: File inclusion - [WordPress Devnex Addons For Elementor plugin <= 1.0.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-53339.md) `CVE-2025-53339` · CVE record: devnex Devnex Addons For Elementor · CVSS 7.5 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress WPB Category Slider for WooCommerce plugin <= 1.71 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-53281.md) `CVE-2025-53281` · CVE record: WPBean WPB Category Slider for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Hotel Booking plugin <= 3.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-53259.md) `CVE-2025-53259` · CVE record: nicdark Hotel Booking · CVSS 7.5 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Gmedia Photo Gallery plugin <= 1.23.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-53257.md) `CVE-2025-53257` · CVE record: Serhii Pasyuk Gmedia Photo Gallery · CVSS 7.5 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Zenny theme <= 1.7.5 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-24769.md) `CVE-2025-24769` · CVE record: BZOTheme Zenny · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress PrintXtore theme < 1.7.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-28946.md) `CVE-2025-28946` · CVE record: BZOTheme PrintXtore · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-28947.md) `CVE-2025-28947` · CVE record: snstheme MBStore - Digital WooCommerce WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress SNS Vicky theme <= 3.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-28990.md) `CVE-2025-28990` · CVE record: snstheme SNS Vicky · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress SERPed.net plugin <= 4.6 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-28998.md) `CVE-2025-28998` · CVE record: serpednet SERPed.net · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Puca theme <= 2.6.33 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-30992.md) `CVE-2025-30992` · CVE record: thembay Puca · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress CTUsers plugin <= 1.0.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32298.md) `CVE-2025-32298` · CVE record: Case-Themes CTUsers · CVSS 7.5 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Greenmart theme <= 4.2.3 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49883.md) `CVE-2025-49883` · CVE record: thembay Greenmart · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Zikzag Core plugin <= 1.4.5 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49886.md) `CVE-2025-49886` · CVE record: WebGeniusLab Zikzag Core · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Networker theme <= 1.2.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52723.md) `CVE-2025-52723` · CVE record: codesupplyco Networker · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Diza theme <= 1.3.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52729.md) `CVE-2025-52729` · CVE record: thembay Diza · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52808.md) `CVE-2025-52808` · CVE record: real-web RealtyElite · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52809.md) `CVE-2025-52809` · CVE record: John Russell National Weather Service Alerts · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Domnoo theme <= 1.49 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52812.md) `CVE-2025-52812` · CVE record: ApusWP Domnoo · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52814.md) `CVE-2025-52814` · CVE record: ovatheme BRW · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress CityGov theme <= 1.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52815.md) `CVE-2025-52815` · CVE record: AncoraThemes CityGov · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52816.md) `CVE-2025-52816` · CVE record: themehunk Zita · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2023-25998.md) `CVE-2023-25998` · CVE record: snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-24760.md) `CVE-2025-24760` · CVE record: goalthemes Sofass · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [WordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49416.md) `CVE-2025-49416` · CVE record: Fastw3b LLC FW Gallery · CVSS 8.1 High · Not analysed yet · Published 27 Jun 2025 · Tags: File inclusion - [Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2025-52562.md) `CVE-2025-52562` · CVE record: ConvoyPanel panel · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2025 · Tags: Path traversal, File inclusion - [WordPress Classified Listing plugin <= 4.2.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52715.md) `CVE-2025-52715` · CVE record: RadiusTheme Classified Listing · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2025 · Tags: File inclusion - [WordPress HUSKY plugin <= 1.3.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-52708.md) `CVE-2025-52708` · CVE record: RealMag777 HUSKY · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2025 · Tags: File inclusion - [WordPress CozyStay theme < 1.7.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-49508.md) `CVE-2025-49508` · CVE record: LoftOcean CozyStay · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress DSK theme < 2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-24761.md) `CVE-2025-24761` · CVE record: snstheme DSK · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Evon theme <= 3.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-28991.md) `CVE-2025-28991` · CVE record: snstheme Evon · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Simen theme <= 4.6 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-29002.md) `CVE-2025-29002` · CVE record: snstheme Simen · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress WPGYM <= 65.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-32549.md) `CVE-2025-32549` · CVE record: mojoomla WPGYM · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress School Management <= 93.0.0 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-47572.md) `CVE-2025-47572` · CVE record: mojoomla School Management · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Fana theme <= 1.1.28 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49251.md) `CVE-2025-49251` · CVE record: thembay Fana · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Besa theme <= 2.3.8 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49252.md) `CVE-2025-49252` · CVE record: thembay Besa · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Lasa theme <= 1.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49253.md) `CVE-2025-49253` · CVE record: thembay Lasa · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Nika theme <= 1.2.8 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49254.md) `CVE-2025-49254` · CVE record: thembay Nika · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Ruza theme <= 1.0.7 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49255.md) `CVE-2025-49255` · CVE record: thembay Ruza · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Sapa theme <= 1.1.14 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49256.md) `CVE-2025-49256` · CVE record: thembay Sapa · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Zota theme <= 1.3.8 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49257.md) `CVE-2025-49257` · CVE record: thembay Zota · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Maia theme <= 1.1.15 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49258.md) `CVE-2025-49258` · CVE record: thembay Maia · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Hara theme <= 1.2.10 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49259.md) `CVE-2025-49259` · CVE record: thembay Hara · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Aora theme <= 1.3.9 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49260.md) `CVE-2025-49260` · CVE record: thembay Aora · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [WordPress Diza theme <= 1.3.8 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-49261.md) `CVE-2025-49261` · CVE record: thembay Diza · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2025 · Tags: File inclusion - [Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2025-4200.md) `CVE-2025-4200` · CVE record: BZOTheme Zagg - Electronics & Accessories WooCommerce WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 14 Jun 2025 · Tags: File inclusion - [WordPress TinySalt theme < 3.10.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-49454.md) `CVE-2025-49454` · CVE record: LoftOcean TinySalt · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2025 · Tags: File inclusion Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .