# File inclusion. A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter](https://agentprime.io/advisories/CVE-2026-12923.md) `CVE-2026-12923` · CVE record: emarket-design Video Gallery – YouTube Gallery, Playlist & Video Grid · CVSS 7.5 High · Not analysed yet · Published 1 Jul 2026 · Tags: File inclusion - [CakePHP: View::element() is missing a path containment check](https://agentprime.io/advisories/GHSA-wpvj-hjcr-h3p2.md) `GHSA-wpvj-hjcr-h3p2`, `CVE-2026-48820`, `PKSA-wx2k-k564-z67n` · Packagist `cakephp/cakephp`: affected `<4.5.11 || >=4.6.0, <4.6.4 || >=5.0.0, <5.1.7 || >=5.2.0, <5.2.13 || >=5.3.0, <5.3.6`, fixed in `4.5.11`, `4.6.4`, `5.1.7`, `5.2.13`, `5.3.6` · CVSS 6.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, File inclusion - [WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57647.md) `CVE-2026-57647` · CVE record: bPlugins Panorama Viewer – 360 Degree Image + Video Viewer · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: File inclusion - [WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68064.md) `CVE-2025-68064` · CVE record: Everthemess Goya Core · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: File inclusion - [WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68063.md) `CVE-2025-68063` · CVE record: StylemixThemes Splash - Sport Club WordPress Theme for Basketball, Football, Hockey · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: File inclusion - [WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-54845.md) `CVE-2026-54845` · CVE record: PluginUs.Net MDTF · CVSS 8.1 High · Not analysed yet · Published 25 Jun 2026 · Tags: File inclusion - [Joomla! Component Easy Shop 1.2.3 Local File Inclusion](https://agentprime.io/advisories/CVE-2019-25760.md) `CVE-2019-25760` · CVE record: Joomtech Easy Shop · CVSS 6.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: File inclusion - [BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style](https://agentprime.io/advisories/CVE-2026-7515.md) `CVE-2026-7515` · CVE record: betterdocs BetterDocs Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: File inclusion - [WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-54814.md) `CVE-2026-54814` · CVE record: StylemixThemes Motors · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39590.md) `CVE-2026-39590` · CVE record: ThemeMove Atomlab · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39559.md) `CVE-2026-39559` · CVE record: codesupplyco Uppercase · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39523.md) `CVE-2026-39523` · CVE record: Elated-Themes Solene Core · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69175.md) `CVE-2025-69175` · CVE record: ThemeREX Line Agency · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Etude theme <= 1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69174.md) `CVE-2025-69174` · CVE record: ThemeREX Etude · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Eventicity theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69170.md) `CVE-2025-69170` · CVE record: ThemeREX Eventicity · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Gunslinger theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69166.md) `CVE-2025-69166` · CVE record: ThemeREX Gunslinger · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Skyward theme <= 1.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69164.md) `CVE-2025-69164` · CVE record: ThemeREX Skyward · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Granola theme <= 1.13 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69158.md) `CVE-2025-69158` · CVE record: ThemeREX Granola · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Gamic theme <= 1.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69157.md) `CVE-2025-69157` · CVE record: ThemeREX Gamic · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Preservation theme <= 1.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69144.md) `CVE-2025-69144` · CVE record: ThemeREX Preservation · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69126.md) `CVE-2025-69126` · CVE record: ThemeREX Fortius · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69123.md) `CVE-2025-69123` · CVE record: ThemeREX Snow Club · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Dazzle theme <= 1.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69120.md) `CVE-2025-69120` · CVE record: ThemeREX Dazzle · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme theme <= 1.2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69115.md) `CVE-2025-69115` · CVE record: ThemeREX LuxMed | Medicine & Healthcare Doctor WordPress Theme · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Imba theme <= 1.5.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69106.md) `CVE-2025-69106` · CVE record: ThemeREX Imba · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress ChapterOne theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-40731.md) `CVE-2026-40731` · CVE record: Mikado-Themes ChapterOne · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Element Pack Pro plugin <= 9.0.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-40721.md) `CVE-2026-40721` · CVE record: BdThemes Element Pack Pro · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Hitek theme < 1.8.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39582.md) `CVE-2026-39582` · CVE record: xtemos Hitek · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Malmö theme <= 2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39558.md) `CVE-2026-39558` · CVE record: Elated-Themes Malmö · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Mikado Core plugin <= 1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39537.md) `CVE-2026-39537` · CVE record: Mikado-Themes Mikado Core · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress EcoBlue theme <= 1.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22338.md) `CVE-2026-22338` · CVE record: ThemeREX EcoBlue · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress AutoParts theme <= 1.5.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22331.md) `CVE-2026-22331` · CVE record: ThemeREX AutoParts · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22330.md) `CVE-2026-22330` · CVE record: Themeum Right Way · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Reprizo theme <= 1.0.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22326.md) `CVE-2026-22326` · CVE record: AxiomThemes Reprizo · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Promo theme <= 1.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22325.md) `CVE-2026-22325` · CVE record: AxiomThemes Promo · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Tipsy theme <= 1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69173.md) `CVE-2025-69173` · CVE record: ThemeREX Tipsy · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Resurs theme <= 1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69172.md) `CVE-2025-69172` · CVE record: ThemeREX Resurs · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Orpheus theme <= 1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69171.md) `CVE-2025-69171` · CVE record: ThemeREX Orpheus · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Snowy theme <= 1.13 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69161.md) `CVE-2025-69161` · CVE record: ThemeREX Snowy · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Quirky theme <= 1.23 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69148.md) `CVE-2025-69148` · CVE record: ThemeREX Quirky · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Gat theme <= 1.16 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69145.md) `CVE-2025-69145` · CVE record: ThemeREX Gat · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Ingenioso theme <= 1.14.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69117.md) `CVE-2025-69117` · CVE record: ThemeREX Ingenioso · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress AirSupply theme <= 2.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69110.md) `CVE-2025-69110` · CVE record: ThemeREX AirSupply · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress HomeRoofer theme <= 2.11.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58954.md) `CVE-2025-58954` · CVE record: ThemeREX HomeRoofer · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Joly theme <= 1.22.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58953.md) `CVE-2025-58953` · CVE record: ThemeREX Joly · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Neuronet theme < 1.14.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58952.md) `CVE-2025-58952` · CVE record: ThemeREX Neuronet · CVSS 8.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Premium Age Verification / Restriction for WordPress Plugin <= 3.0.2 - Arbitrary File Download Vulnerability](https://agentprime.io/advisories/CVE-2025-49403.md) `CVE-2025-49403` · CVE record: AA-Team Premium Age Verification / Restriction for WordPress · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: File inclusion - [WordPress Mr. SEO theme <= 2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39568.md) `CVE-2026-39568` · CVE record: Elated-Themes Mr. SEO · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Aperitif theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39549.md) `CVE-2026-39549` · CVE record: Elated-Themes Aperitif · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Getaway theme < 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39547.md) `CVE-2026-39547` · CVE record: Select-Themes Getaway · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Solene theme <= 3.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-39522.md) `CVE-2026-39522` · CVE record: Elated-Themes Solene · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Softlab Core plugin < 1.2.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-34895.md) `CVE-2026-34895` · CVE record: WebGeniusLab Softlab Core · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Integrio Core plugin < 1.2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-34894.md) `CVE-2026-34894` · CVE record: WebGeniusLab Integrio Core · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Thegov Core plugin < 2.0.23 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-34893.md) `CVE-2026-34893` · CVE record: WebGeniusLab Thegov Core · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Truemag theme <= 4.3.14.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69178.md) `CVE-2025-69178` · CVE record: CactusThemes Truemag · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Roneous theme <= 2.1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69177.md) `CVE-2025-69177` · CVE record: THEMELOGI Roneous · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress ITactics theme <= 1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69176.md) `CVE-2025-69176` · CVE record: ThemeREX ITactics · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Spike theme <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69168.md) `CVE-2025-69168` · CVE record: ThemeREX Spike · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Eros theme <= 1.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69167.md) `CVE-2025-69167` · CVE record: ThemeREX Eros · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion - [WordPress Choreo theme <= 1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69165.md) `CVE-2025-69165` · CVE record: ThemeREX Choreo · CVSS 8.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: File inclusion Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .