# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [LT Unleashed <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion via 'template' Parameter](https://agentprime.io/advisories/CVE-2025-13886.md)
  `CVE-2025-13886` · CVE record: cvedovini LT Unleashed · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2025 · Tags: File inclusion
- [FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings](https://agentprime.io/advisories/CVE-2024-58302.md)
  `CVE-2024-58302` · CVE record: Flarum FriendsofFlarum Pretty Mail · CVSS 6.9 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: File inclusion
- [WordPress The7 Elements plugin <= 2.7.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-63076.md)
  `CVE-2025-63076` · CVE record: Dream-Theme The7 Elements · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress The7 theme < 12.8.1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-63074.md)
  `CVE-2025-63074` · CVE record: Dream-Theme The7 · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress UDesign Core plugin <= 4.14.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-63062.md)
  `CVE-2025-63062` · CVE record: AndonDesign UDesign Core · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Ronneby Theme Core plugin <= 1.5.68 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-63036.md)
  `CVE-2025-63036` · CVE record: DFDevelopment Ronneby Theme Core · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress North - Required Plugin plugin <= 1.4.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-63003.md)
  `CVE-2025-63003` · CVE record: fuelthemes North - Required Plugin · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67532.md)
  `CVE-2025-67532` · CVE record: thembay Hara · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Turitor theme < 1.5.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67531.md)
  `CVE-2025-67531` · CVE record: trippleS Turitor · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67530.md)
  `CVE-2025-67530` · CVE record: thembay Besa · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Fashion theme < 5.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67529.md)
  `CVE-2025-67529` · CVE record: Opal_WP Fashion · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67528.md)
  `CVE-2025-67528` · CVE record: thembay Urna · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Digiqole theme < 2.2.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67527.md)
  `CVE-2025-67527` · CVE record: trippleS Digiqole · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Sailing theme < 4.4.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67526.md)
  `CVE-2025-67526` · CVE record: ThimPress Sailing · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress ekommart theme < 4.3.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67525.md)
  `CVE-2025-67525` · CVE record: Opal_WP ekommart · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Jobmonster Elementor Addon plugin <= 1.1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67524.md)
  `CVE-2025-67524` · CVE record: NooTheme Jobmonster Elementor Addon · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Exhibz theme <= 3.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67523.md)
  `CVE-2025-67523` · CVE record: trippleS Exhibz · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Jobmonster theme <= 4.8.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67522.md)
  `CVE-2025-67522` · CVE record: NooTheme Jobmonster · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Select Core plugin < 2.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67521.md)
  `CVE-2025-67521` · CVE record: Select-Themes Select Core · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [WordPress Wilmër theme < 3.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67515.md)
  `CVE-2025-67515` · CVE record: Mikado-Themes Wilmër · CVSS 8.8 High · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to the index.php.](https://agentprime.io/advisories/CVE-2025-63738.md)
  `CVE-2025-63738` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: File inclusion
- [My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller](https://agentprime.io/advisories/CVE-2025-12851.md)
  `CVE-2025-12851` · CVE record: wphocus My auctions allegro · CVSS 8.1 High · Not analysed yet · Published 5 Dec 2025 · Tags: File inclusion
- [dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/VersionManager.php.](https://agentprime.io/advisories/CVE-2025-65656.md)
  `CVE-2025-65656` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Dec 2025 · Tags: File inclusion
- [WordPress Easy Invoice plugin <= 2.1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-66115.md)
  `CVE-2025-66115` · CVE record: MatrixAddons Easy Invoice · CVSS 6.6 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: File inclusion
- [The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.](https://agentprime.io/advisories/CVE-2025-63888.md)
  `CVE-2025-63888` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Nov 2025 · Tags: File inclusion
- [Unauthenticated Local File Inclusion in php module](https://agentprime.io/advisories/CVE-2025-41734.md)
  `CVE-2025-41734` · CVE record: METZ CONNECT Energy-Controlling EWIO2-M and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2025 · Tags: File inclusion
- [Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2025-13088.md)
  `CVE-2025-13088` · CVE record: ikhodal Category and Product Woocommerce Tabs · CVSS 8.8 High · Not analysed yet · Published 18 Nov 2025 · Tags: File inclusion
- [PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal](https://agentprime.io/advisories/GHSA-g2j9-g8r5-rg82.md)
  `GHSA-g2j9-g8r5-rg82`, `CVE-2025-64714`, `PKSA-fq4v-3kvp-3kj2` · Packagist `privatebin/privatebin`: affected `>=1.7.7, <2.0.3`, fixed in `2.0.3` · CVSS 5.8 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: Path traversal, File inclusion
- [DBLTek GoIP-1 vGHSFVT-1.1-67-5 Unauthenticated LFI](https://agentprime.io/advisories/CVE-2022-4982.md)
  `CVE-2022-4982` · CVE record: DBL Technology (DBLTek) GoIP-1 · CVSS 8.7 High · Not analysed yet · Published 12 Nov 2025 · Tags: Path traversal, File inclusion
- [A Local File Inclusion (LFI) vulnerability has been identified in tQuadra CMS 4.2.1117.](https://agentprime.io/advisories/CVE-2025-60574.md)
  `CVE-2025-60574` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Nov 2025 · Tags: Path traversal, File inclusion
- [WordPress Alloggio - Hotel Booking Theme theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-64287.md)
  `CVE-2025-64287` · CVE record: Edge-Themes Alloggio - Hotel Booking · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Simple Payment plugin <= 2.4.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62075.md)
  `CVE-2025-62075` · CVE record: Ido Kobelkowsky Simple Payment · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Savory theme <= 2.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62067.md)
  `CVE-2025-62067` · CVE record: Elated-Themes Savory · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Revolution theme < 2.5.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62066.md)
  `CVE-2025-62066` · CVE record: fuelthemes Revolution · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Academist theme < 1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62055.md)
  `CVE-2025-62055` · CVE record: Elated-Themes Academist · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62053.md)
  `CVE-2025-62053` · CVE record: favethemes Houzez · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62045.md)
  `CVE-2025-62045` · CVE record: CodexThemes TheGem Theme Elements (for WPBakery) · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress ITok theme <= 1.1.42 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62014.md)
  `CVE-2025-62014` · CVE record: ApusTheme ITok · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Famita theme <= 1.54 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62010.md)
  `CVE-2025-62010` · CVE record: ApusTheme Famita · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress WPC Product Options for WooCommerce plugin <= 3.1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60248.md)
  `CVE-2025-60248` · CVE record: WPClever WPC Product Options for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60241.md)
  `CVE-2025-60241` · CVE record: Premmerce Premmerce · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress AnyComment plugin <= 0.3.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60240.md)
  `CVE-2025-60240` · CVE record: Alexander AnyComment · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress WooCommerce Store Toolkit plugin <= 2.4.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60204.md)
  `CVE-2025-60204` · CVE record: Josh Kohlbach WooCommerce Store Toolkit · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Store Exporter plugin <= 2.7.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60203.md)
  `CVE-2025-60203` · CVE record: Josh Kohlbach Store Exporter · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Favorites plugin <= 2.3.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60202.md)
  `CVE-2025-60202` · CVE record: Kyle Phillips Favorites · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress WP Customer Area plugin <= 8.3.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60201.md)
  `CVE-2025-60201` · CVE record: aguilatechnologies WP Customer Area · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60200.md)
  `CVE-2025-60200` · CVE record: ThimPress LearnPress Export Import · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress InHype - Blog & Magazine WordPress Theme theme <= 1.5.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60199.md)
  `CVE-2025-60199` · CVE record: dedalx InHype - Blog & Magazine WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Saxon - Viral Content Blog & Magazine Marketing WordPress Theme theme <= 1.9.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60198.md)
  `CVE-2025-60198` · CVE record: dedalx Saxon - Viral Content Blog & Magazine Marketing WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Simple Contact Forms plugin <= 1.6.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60197.md)
  `CVE-2025-60197` · CVE record: owenr88 Simple Contact Forms · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Clearblue® Ovulation Calculator plugin <= 1.2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60196.md)
  `CVE-2025-60196` · CVE record: Clearblue Clearblue® Ovulation Calculator · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Premmerce Product Search for WooCommerce plugin <= 2.2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60194.md)
  `CVE-2025-60194` · CVE record: Premmerce Premmerce Product Search for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Premmerce User Roles plugin <= 1.0.13 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60193.md)
  `CVE-2025-60193` · CVE record: Premmerce Premmerce User Roles · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Premmerce Wholesale Pricing for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60192.md)
  `CVE-2025-60192` · CVE record: Premmerce Premmerce Wholesale Pricing for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60191.md)
  `CVE-2025-60191` · CVE record: Premmerce Premmerce Wishlist for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Immocaster WordPress Plugin plugin <= 1.3.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60190.md)
  `CVE-2025-60190` · CVE record: Hinnerk Altenburg Immocaster WordPress Plugin · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress PoloPag – Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60189.md)
  `CVE-2025-60189` · CVE record: PoloPag PoloPag – Pix Automático para Woocommerce · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60074.md)
  `CVE-2025-60074` · CVE record: Processby Lazy Load Optimizer · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Responsive Sidebar plugin <= 1.2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60073.md)
  `CVE-2025-60073` · CVE record: Processby Responsive Sidebar · CVSS 7.5 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion
- [WordPress Leblix Theme <= 2.4 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-58995.md)
  `CVE-2025-58995` · CVE record: Creatives_Planet Leblix · CVSS 8.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI1LTExLTA2VDE1OjU0OjMzLjY1NDAwMFoiLCJDVkUtMjAyNS01ODk5NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI1LTEyLTEzVDA0OjMxOjI0LjUyMjAwMFoiLCJDVkUtMjAyNS0xNDQ3NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI1LTEyLTEzVDA0OjMxOjI0LjUyMjAwMFoiLCJDVkUtMjAyNS0xNDQ3NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.