# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress WineShop theme <= 3.17 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69163.md)
  `CVE-2025-69163` · CVE record: ThemeREX WineShop · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Grecko theme <= 5.17 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69162.md)
  `CVE-2025-69162` · CVE record: ThemeREX Grecko · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Gita theme <= 1.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69160.md)
  `CVE-2025-69160` · CVE record: ThemeREX Gita · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Printo theme <= 1.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69159.md)
  `CVE-2025-69159` · CVE record: ThemeREX Printo · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Medeus theme <= 1.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69150.md)
  `CVE-2025-69150` · CVE record: ThemeREX Medeus · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Top Dog theme <= 1.0.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69149.md)
  `CVE-2025-69149` · CVE record: ThemeREX Top Dog · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Putter theme <= 1.17 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69147.md)
  `CVE-2025-69147` · CVE record: ThemeREX Putter · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Dom theme <= 1.24 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69146.md)
  `CVE-2025-69146` · CVE record: ThemeREX Dom · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Mission theme <= 1.22 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69143.md)
  `CVE-2025-69143` · CVE record: ThemeREX Mission · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Abelle theme <= 1.22 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69142.md)
  `CVE-2025-69142` · CVE record: ThemeREX Abelle · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Kelly Young theme <= 1.1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69141.md)
  `CVE-2025-69141` · CVE record: ThemeREX Kelly Young · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Wanium theme <= 1.9.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69136.md)
  `CVE-2025-69136` · CVE record: THEMELOGI Wanium · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Food Drop theme <= 1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69125.md)
  `CVE-2025-69125` · CVE record: ThemeREX Food Drop · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Especio theme <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69124.md)
  `CVE-2025-69124` · CVE record: ThemeREX Especio · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Deliciosa theme <= 1.10.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69121.md)
  `CVE-2025-69121` · CVE record: ThemeREX Deliciosa · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Corbesier theme <= 1.15.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69119.md)
  `CVE-2025-69119` · CVE record: ThemeREX Corbesier · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress CopyPress theme <= 1.4.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69118.md)
  `CVE-2025-69118` · CVE record: ThemeREX CopyPress · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Iona theme <= 1.0.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69116.md)
  `CVE-2025-69116` · CVE record: ThemeREX Iona · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69114.md)
  `CVE-2025-69114` · CVE record: ThemeREX MaxiNet · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69113.md)
  `CVE-2025-69113` · CVE record: ThemeREX Nexio · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Planty theme <= 1.14.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69112.md)
  `CVE-2025-69112` · CVE record: ThemeREX Planty · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Raider Spirit theme <= 1.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69109.md)
  `CVE-2025-69109` · CVE record: ThemeREX Raider Spirit · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69107.md)
  `CVE-2025-69107` · CVE record: ThemeREX Rosaleen · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Modernee theme <= 1.6.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69105.md)
  `CVE-2025-69105` · CVE record: ThemeREX Modernee · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Learnify theme <= 1.15.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60085.md)
  `CVE-2025-60085` · CVE record: ThemeREX Group Learnify · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [WordPress Geya theme <= 1.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58924.md)
  `CVE-2025-58924` · CVE record: ThemeREX Group Geya · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion
- [Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory](https://agentprime.io/advisories/CVE-2026-49954.md)
  `CVE-2026-49954` · CVE record: Discuz! Discuz! X5.0 · CVSS 8.6 High · Not analysed yet · Published 15 Jun 2026 · Tags: File inclusion
- [WordPress Plugin Abtest Local File Inclusion via abtest_admin.php](https://agentprime.io/advisories/CVE-2016-20082.md)
  `CVE-2016-20082` · CVE record: abtest Abtest · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: File inclusion
- [WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php](https://agentprime.io/advisories/CVE-2016-20080.md)
  `CVE-2016-20080` · CVE record: Brandfolder Brandfolder · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: File inclusion
- [WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php](https://agentprime.io/advisories/CVE-2016-20079.md)
  `CVE-2016-20079` · CVE record: jamie Dharma Booking · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: File inclusion
- [WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php](https://agentprime.io/advisories/CVE-2016-20078.md)
  `CVE-2016-20078` · CVE record: Henrique Dias IMDb Profile Widget · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: File inclusion
- [WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php](https://agentprime.io/advisories/CVE-2016-20077.md)
  `CVE-2016-20077` · CVE record: KaymeePhotography Photocart Link · CVSS 6.9 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: File inclusion
- [WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter](https://agentprime.io/advisories/CVE-2016-20064.md)
  `CVE-2016-20064` · CVE record: myasui WP Vault · CVSS 6.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: File inclusion
- [Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter](https://agentprime.io/advisories/CVE-2026-9662.md)
  `CVE-2026-9662` · CVE record: plasmatizemedia Recover Exit For WooCommerce · CVSS 8.1 High · Not analysed yet · Published 9 Jun 2026 · Tags: File inclusion
- [WordPress Cookiteer theme <= 1.4.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68886.md)
  `CVE-2025-68886` · CVE record: androThemes Cookiteer · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress Racquet theme <= 1.12.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69369.md)
  `CVE-2025-69369` · CVE record: Axiomthemes Racquet · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58897.md)
  `CVE-2025-58897` · CVE record: Axiomthemes Fermentio · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58707.md)
  `CVE-2025-58707` · CVE record: Axiomthemes Spin · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39553.md)
  `CVE-2026-39553` · CVE record: Select-Themes WaveRide · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39552.md)
  `CVE-2026-39552` · CVE record: Code Supply Co. Blueprint · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58705.md)
  `CVE-2025-58705` · CVE record: Axiomthemes Crafti · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress Accordion FAQ Plugin <= 2.2.1 - Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2025-58024.md)
  `CVE-2025-58024` · CVE record: UnboundStudio Accordion FAQ · CVSS 7.5 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [WordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-53440.md)
  `CVE-2025-53440` · CVE record: Axiomthemes Confidant · CVSS 8.1 High · Not analysed yet · Published 2 Jun 2026 · Tags: File inclusion
- [FreePBX: Authenticated Local File Inclusion in Dashboard Module](https://agentprime.io/advisories/CVE-2026-44239.md)
  `CVE-2026-44239` · CVE record: FreePBX security-reporting · CVSS 7.6 High · Not analysed yet · Published 29 May 2026 · Tags: File inclusion
- [An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_download.php component](https://agentprime.io/advisories/CVE-2026-37266.md)
  `CVE-2026-37266` · CVE record · CVSS 8.0 High · Not analysed yet · Published 28 May 2026 · Tags: File inclusion
- [WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-48972.md)
  `CVE-2026-48972` · CVE record: SeedProd LLC SeedProd Pro · CVSS 7.5 High · Not analysed yet · Published 27 May 2026 · Tags: File inclusion
- [Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-9200.md)
  `CVE-2026-9200` · CVE record: shazdeh Query Shortcode · CVSS 7.5 High · Not analysed yet · Published 27 May 2026 · Tags: File inclusion
- [Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup](https://agentprime.io/advisories/GHSA-9hx7-c53c-v6x8.md)
  `GHSA-9hx7-c53c-v6x8`, `CVE-2026-44177`, `PKSA-82wy-dsmt-xgpc` · Packagist `getkirby/cms`: affected `>=5.3.0, <5.4.1`, fixed in `5.4.1` · CVSS 8.8 High · Not analysed yet · Published 26 May 2026 · Tags: Path traversal, File inclusion
- [Identity Awareness Captive Portal - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2026-48133.md)
  `CVE-2026-48133` · CVE record: checkpoint Quantum Security Gateway · CVSS 7.5 High · Not analysed yet · Published 26 May 2026 · Tags: File inclusion
- [WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39661.md)
  `CVE-2026-39661` · CVE record: Magentech SW Core · CVSS 7.5 High · Not analysed yet · Published 26 May 2026 · Tags: File inclusion
- [Concrete CMS Vulnerable to Relative Path Traversal](https://agentprime.io/advisories/GHSA-645j-cm4x-3xvw.md)
  `GHSA-645j-cm4x-3xvw`, `CVE-2026-8134`, `PKSA-sqtt-5khz-wksh` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: Path traversal, File inclusion, Unrestricted file upload
- [Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'](https://agentprime.io/advisories/CVE-2026-7522.md)
  `CVE-2026-7522` · CVE record: SigmaPlugin Advanced Database Cleaner – Premium · CVSS 8.8 High · Not analysed yet · Published 20 May 2026 · Tags: File inclusion
- [WordPress Plugin WP with Spritz 1.0 Remote File Inclusion](https://agentprime.io/advisories/CVE-2018-25329.md)
  `CVE-2018-25329` · CVE record: wp-with-spritz WP with Spritz · CVSS 8.7 High · Not analysed yet · Published 17 May 2026 · Tags: File inclusion
- [Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath](https://agentprime.io/advisories/CVE-2018-25324.md)
  `CVE-2018-25324` · CVE record: Simple-Fields Simple Fields · CVSS 6.9 Medium · Not analysed yet · Published 17 May 2026 · Tags: File inclusion
- [ProcessMaker 3.5.4 Local File Inclusion via Path Traversal](https://agentprime.io/advisories/CVE-2021-47978.md)
  `CVE-2021-47978` · CVE record: Processmaker ProcessMaker · CVSS 6.9 Medium · Not analysed yet · Published 16 May 2026 · Tags: File inclusion
- [WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion](https://agentprime.io/advisories/CVE-2020-37246.md)
  `CVE-2020-37246` · CVE record: Supsystic Backup · CVSS 6.9 Medium · Not analysed yet · Published 16 May 2026 · Tags: File inclusion
- [WordPress Plugin ultimate-member 2.1.3 Local File Inclusion](https://agentprime.io/advisories/CVE-2020-37169.md)
  `CVE-2020-37169` · CVE record: Ultimate Member ultimate-member · CVSS 6.8 Medium · Not analysed yet · Published 13 May 2026 · Tags: File inclusion
- [RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'](https://agentprime.io/advisories/CVE-2026-3425.md)
  `CVE-2026-3425` · CVE record: rometheme RTMKit · CVSS 8.8 High · Not analysed yet · Published 13 May 2026 · Tags: File inclusion
- [Yii 2: Local file inclusion via view parameter name collision](https://agentprime.io/advisories/GHSA-5vpg-rj7q-qpw2.md)
  `GHSA-5vpg-rj7q-qpw2`, `CVE-2026-39850`, `PKSA-mxtc-f5ct-dqqd` · Packagist `yiisoft/yii2`: affected `<2.0.55`, fixed in `2.0.55` · CVSS 7.4 High · Not analysed yet · Published 11 May 2026 · Tags: File inclusion, CWE-20
- [WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion](https://agentprime.io/advisories/CVE-2022-50954.md)
  `CVE-2022-50954` · CVE record: cab-fare-calculator cab-fare-calculator · CVSS 6.9 Medium · Not analysed yet · Published 10 May 2026 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI2LTA1LTEwVDEyOjEyOjQ5LjkxMzAwMFoiLCJDVkUtMjAyMi01MDk1NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI2LTA2LTE2VDIwOjU3OjE3LjE0NjAwMFoiLCJDVkUtMjAyNS02OTE2NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI2LTA2LTE2VDIwOjU3OjE3LjE0NjAwMFoiLCJDVkUtMjAyNS02OTE2NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.