# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter](https://agentprime.io/advisories/CVE-2026-15667.md)
  `CVE-2026-15667` · CVE record: arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce · CVSS 7.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: File inclusion
- [Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter](https://agentprime.io/advisories/CVE-2026-15406.md)
  `CVE-2026-15406` · CVE record: arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce · CVSS 7.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: File inclusion
- [Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter](https://agentprime.io/advisories/CVE-2026-11613.md)
  `CVE-2026-11613` · CVE record: Divi Engine Divi Ajax Filter · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: File inclusion
- [Måne <= 1.7 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2026-78478.md)
  `CVE-2026-78478` · CVE record: Elated-Themes Mane · CVSS 8.1 High · Not analysed yet · Published 25 Aug 2026 · Tags: File inclusion
- [Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data\[updates\]' Array Keys](https://agentprime.io/advisories/CVE-2026-14280.md)
  `CVE-2026-14280` · CVE record: netweblogic Events Manager – Calendar, Bookings, Tickets, and more! · CVSS 6.6 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: File inclusion
- [WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32560.md)
  `CVE-2026-32560` · CVE record: LiquidThemes MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator · CVSS 8.8 High · Not analysed yet · Published 24 Aug 2026 · Tags: File inclusion
- [WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66670.md)
  `CVE-2026-66670` · CVE record: Elated-Themes Måne · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: File inclusion
- [WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66587.md)
  `CVE-2026-66587` · CVE record: WPCafe WP Cafe Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: File inclusion
- [WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28152.md)
  `CVE-2026-28152` · CVE record: Select-Themes Tonda Core · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: File inclusion
- [WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28151.md)
  `CVE-2026-28151` · CVE record: Select-Themes Tonda · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: File inclusion
- [WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66671.md)
  `CVE-2026-66671` · CVE record: Elated-Themes Verdure Core · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: File inclusion
- [WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66586.md)
  `CVE-2026-66586` · CVE record: Themewinter WP Cafe Pro · CVSS 6.6 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: File inclusion
- [WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28150.md)
  `CVE-2026-28150` · CVE record: uxper Golo Framework · CVSS 8.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: File inclusion
- [WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-15637.md)
  `CVE-2025-15637` · CVE record: Edge Themes Shuffle · CVSS 8.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: File inclusion
- [Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property](https://agentprime.io/advisories/CVE-2026-75963.md)
  `CVE-2026-75963` · CVE record: liedekef Events Made Easy · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: File inclusion
- [WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-73387.md)
  `CVE-2026-73387` · CVE record: SmartDataSoft Resido · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: File inclusion
- [WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-73400.md)
  `CVE-2026-73400` · CVE record: jetmonsters Restaurant Menu by MotoPress · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: File inclusion
- [WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32464.md)
  `CVE-2026-32464` · CVE record: Vladimir Prelovac Theme Test Drive · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: File inclusion
- [WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28570.md)
  `CVE-2026-28570` · CVE record: SpabRice Vavo Core · CVSS 8.1 High · Not analysed yet · Published 18 Aug 2026 · Tags: File inclusion
- [WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66657.md)
  `CVE-2026-66657` · CVE record: Mikado-Themes Biagiotti Core · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: File inclusion
- [WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66656.md)
  `CVE-2026-66656` · CVE record: Mikado-Themes Foton Core · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: File inclusion
- [WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66653.md)
  `CVE-2026-66653` · CVE record: Edge-Themes Barista · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: File inclusion
- [WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66450.md)
  `CVE-2026-66450` · CVE record: Dylan Kuhn Geo Mashup · CVSS 8.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: File inclusion
- [WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66710.md)
  `CVE-2026-66710` · CVE record: E2Pdf e2pdf · CVSS 8.1 High · Not analysed yet · Published 6 Aug 2026 · Tags: File inclusion
- [Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field](https://agentprime.io/advisories/CVE-2026-17605.md)
  `CVE-2026-17605` · CVE record: stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid · CVSS 6.6 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: File inclusion
- [Local File Inclusion in Quick.CMS](https://agentprime.io/advisories/CVE-2026-63302.md)
  `CVE-2026-63302` · CVE record: OpenSolution Quick.CMS · CVSS 5.1 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: File inclusion
- [WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-65481.md)
  `CVE-2026-65481` · CVE record: Elated-Themes Vino · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: File inclusion
- [WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-65477.md)
  `CVE-2026-65477` · CVE record: Select-Themes Tonda Core · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: File inclusion
- [Emlog Local File Inclusion (LFI)](https://agentprime.io/advisories/CVE-2026-46687.md)
  `CVE-2026-46687` · CVE record: emlog emlog · CVSS 7.7 High · Not analysed yet · Published 16 Jul 2026 · Tags: Path traversal, File inclusion
- [WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57805.md)
  `CVE-2026-57805` · CVE record: Select-Themes Tonda · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57804.md)
  `CVE-2026-57804` · CVE record: CodexThemes TheGem Theme Elements (for Elementor) · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57803.md)
  `CVE-2026-57803` · CVE record: Select-Themes Struktur Core · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57802.md)
  `CVE-2026-57802` · CVE record: Select-Themes Struktur · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57801.md)
  `CVE-2026-57801` · CVE record: Select-Themes SetSail · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57800.md)
  `CVE-2026-57800` · CVE record: Edge-Themes Overworld · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57799.md)
  `CVE-2026-57799` · CVE record: uxper Nuss · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57798.md)
  `CVE-2026-57798` · CVE record: SaurabhSharma NewsPlus Shortcodes · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57796.md)
  `CVE-2026-57796` · CVE record: VLThemes Leedo · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57795.md)
  `CVE-2026-57795` · CVE record: themelexus Kitchor · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57794.md)
  `CVE-2026-57794` · CVE record: uxper Golo Framework · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57793.md)
  `CVE-2026-57793` · CVE record: Elated-Themes Flow · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57792.md)
  `CVE-2026-57792` · CVE record: Mikado-Themes Dør · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57791.md)
  `CVE-2026-57791` · CVE record: ThemeMove Brook · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57789.md)
  `CVE-2026-57789` · CVE record: jwsthemes Aqua · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57790.md)
  `CVE-2026-57790` · CVE record: ThemeMove Billey · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57788.md)
  `CVE-2026-57788` · CVE record: Edge-Themes Aalto · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57743.md)
  `CVE-2026-57743` · CVE record: stmcan RT-Theme 18 | Extensions · CVSS 8.1 High · Not analysed yet · Published 13 Jul 2026 · Tags: File inclusion
- [SourceCodester Online Book Store System Administrative index.php php file inclusion](https://agentprime.io/advisories/CVE-2026-15540.md)
  `CVE-2026-15540` · CVE record: SourceCodester Online Book Store System · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Path traversal, File inclusion
- [LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting](https://agentprime.io/advisories/CVE-2026-15338.md)
  `CVE-2026-15338` · CVE record: choijun LA-Studio Element Kit for Elementor · CVSS 7.5 High · Not analysed yet · Published 11 Jul 2026 · Tags: File inclusion
- [HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion](https://agentprime.io/advisories/CVE-2025-11977.md)
  `CVE-2025-11977` · CVE record: happyforms Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms · CVSS 6.6 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: File inclusion
- [WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter](https://agentprime.io/advisories/CVE-2026-13080.md)
  `CVE-2026-13080` · CVE record: getwpfunnels WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell · CVSS 6.6 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: File inclusion
- [PHPIPAM Authenticated LFI](https://agentprime.io/advisories/CVE-2026-12194.md)
  `CVE-2026-12194` · CVE record: phpipam phpipam · CVSS 2.3 Low · Not analysed yet · Published 4 Jul 2026 · Tags: File inclusion
- [RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter](https://agentprime.io/advisories/CVE-2026-5137.md)
  `CVE-2026-5137` · CVE record: rometheme RTMKit · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: File inclusion
- [Mautic vulnerable to Path Traversal via Campaign Import](https://agentprime.io/advisories/GHSA-6r9h-4h75-7q4x.md)
  `GHSA-6r9h-4h75-7q4x`, `CVE-2026-9559`, `PKSA-743g-7dzv-xbzg` · Packagist `mautic/core`: affected `>=7.0.0, <7.1.2`, fixed in `7.1.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Path traversal, File inclusion
- [WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57749.md)
  `CVE-2026-57749` · CVE record: ThemeBoy SportsPress Pro · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: File inclusion
- [WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-57748.md)
  `CVE-2026-57748` · CVE record: Shopify Help Center Shopify · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: File inclusion
- [WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-42382.md)
  `CVE-2026-42382` · CVE record: Elated-Themes Audrey · CVSS 8.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: File inclusion
- [WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27412.md)
  `CVE-2026-27412` · CVE record: StylemixThemes Pearl - Corporate Business · CVSS 8.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: File inclusion
- [WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69133.md)
  `CVE-2025-69133` · CVE record: GoodLayers Tourmaster · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: File inclusion
- [WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-58902.md)
  `CVE-2025-58902` · CVE record: AncoraThemes Lighthouse · CVSS 8.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI2LTA3LTAyVDExOjE0OjM5LjM0MDAwMFoiLCJDVkUtMjAyNS01ODkwMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI2LTA5LTA5VDE2OjQ0OjU4LjM3NDAwMFoiLCJDVkUtMjAyNi04NzkyNyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI2LTA5LTA5VDE2OjQ0OjU4LjM3NDAwMFoiLCJDVkUtMjAyNi04NzkyNyJd>. Everything for agents: <https://agentprime.io/llms.txt>.