# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67616.md)
  `CVE-2025-67616` · CVE record: BZOTheme Mella · CVSS 8.1 High · Not analysed yet · Published 22 Jan 2026 · Tags: File inclusion
- [WordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67615.md)
  `CVE-2025-67615` · CVE record: bslthemes Myour · CVSS 8.1 High · Not analysed yet · Published 22 Jan 2026 · Tags: File inclusion
- [WordPress WerkStatt plugin plugin <= 1.6.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-63017.md)
  `CVE-2025-63017` · CVE record: fuelthemes WerkStatt Plugin · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2026 · Tags: File inclusion
- [WordPress Depot theme <= 1.16 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-54003.md)
  `CVE-2025-54003` · CVE record: Mikado-Themes Depot · CVSS 8.1 High · Not analysed yet · Published 22 Jan 2026 · Tags: File inclusion
- [WordPress Amuli theme <= 2.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-50003.md)
  `CVE-2025-50003` · CVE record: axiomthemes Amuli · CVSS 8.1 High · Not analysed yet · Published 22 Jan 2026 · Tags: File inclusion
- [WordPress Athens theme <= 1.1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-49994.md)
  `CVE-2025-49994` · CVE record: ovatheme Athens · CVSS 8.1 High · Not analysed yet · Published 22 Jan 2026 · Tags: File inclusion
- [WordPress Anarkali theme <= 1.0.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-47474.md)
  `CVE-2025-47474` · CVE record: Ninetheme Anarkali · CVSS 8.1 High · Not analysed yet · Published 22 Jan 2026 · Tags: File inclusion
- [News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2025-14502.md)
  `CVE-2025-14502` · CVE record: vaghasia3 News and Blog Designer Bundle · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jan 2026 · Tags: File inclusion
- [mPDF 7.0 - Local File Inclusion](https://agentprime.io/advisories/CVE-2022-50897.md)
  `CVE-2022-50897` · CVE record: mPDF mPDF · CVSS 8.7 High · Not analysed yet · Published 13 Jan 2026 · Tags: File inclusion
- [WordPress Handmade Framework plugin <= 3.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22521.md)
  `CVE-2026-22521` · CVE record: G5Theme Handmade Framework · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Hendon theme < 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67937.md)
  `CVE-2025-67937` · CVE record: Mikado-Themes Hendon · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Curly theme < 3.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67936.md)
  `CVE-2025-67936` · CVE record: Mikado-Themes Curly · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Optimize theme < 2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67935.md)
  `CVE-2025-67935` · CVE record: Mikado-Themes Optimize · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Wellspring theme < 2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67934.md)
  `CVE-2025-67934` · CVE record: Mikado-Themes Wellspring · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Corpkit theme <= 2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67925.md)
  `CVE-2025-67925` · CVE record: zozothemes Corpkit · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67920.md)
  `CVE-2025-67920` · CVE record: Elated-Themes Neo Ocular · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-22712.md)
  `CVE-2025-22712` · CVE record: QantumThemes Typify · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-22708.md)
  `CVE-2025-22708` · CVE record: ThemeMove Mitech · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-22707.md)
  `CVE-2025-22707` · CVE record: ThemeMove Moody · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Atlas theme <= 2.1.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-22509.md)
  `CVE-2025-22509` · CVE record: TMRW-studio Atlas · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Navian theme <= 1.5.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-14431.md)
  `CVE-2025-14431` · CVE record: THEMELOGI Navian · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-14430.md)
  `CVE-2025-14430` · CVE record: ThemeMove Brook · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-14429.md)
  `CVE-2025-14429` · CVE record: ThemeMove AeroLand · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Oshine theme < 7.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-14359.md)
  `CVE-2025-14359` · CVE record: brandexponents Oshine · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress OchaHouse theme <= 2.2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-12550.md)
  `CVE-2025-12550` · CVE record: jwsthemes OchaHouse · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Rozy - Flower Shop theme <= 1.2.25 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-12549.md)
  `CVE-2025-12549` · CVE record: magentech Rozy - Flower Shop · CVSS 8.1 High · Not analysed yet · Published 8 Jan 2026 · Tags: File inclusion
- [WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69080.md)
  `CVE-2025-69080` · CVE record: JanStudio Gecko · CVSS 8.1 High · Not analysed yet · Published 7 Jan 2026 · Tags: File inclusion
- [WordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69081.md)
  `CVE-2025-69081` · CVE record: ThemeREX Hope · CVSS 8.1 High · Not analysed yet · Published 7 Jan 2026 · Tags: File inclusion
- [WordPress WPCHURCH plugin <= 2.7.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-32304.md)
  `CVE-2025-32304` · CVE record: Mojoomla WPCHURCH · CVSS 8.1 High · Not analysed yet · Published 6 Jan 2026 · Tags: File inclusion
- [WordPress Frappé theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69083.md)
  `CVE-2025-69083` · CVE record: Elated-Themes Frappé · CVSS 8.1 High · Not analysed yet · Published 6 Jan 2026 · Tags: File inclusion
- [WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69356.md)
  `CVE-2025-69356` · CVE record: CodexThemes TheGem Theme Elements (for Elementor) · CVSS 7.5 High · Not analysed yet · Published 6 Jan 2026 · Tags: File inclusion
- [WordPress Calafate theme <= 1.7.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69342.md)
  `CVE-2025-69342` · CVE record: VanKarWai Calafate · CVSS 7.5 High · Not analysed yet · Published 6 Jan 2026 · Tags: File inclusion
- [WordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69086.md)
  `CVE-2025-69086` · CVE record: jwsthemes Issabella · CVSS 8.1 High · Not analysed yet · Published 6 Jan 2026 · Tags: File inclusion
- [WordPress FreeAgent theme <= 2.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69087.md)
  `CVE-2025-69087` · CVE record: jwsthemes FreeAgent · CVSS 8.1 High · Not analysed yet · Published 5 Jan 2026 · Tags: File inclusion
- [WordPress MAS Videos plugin <= 1.3.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-62753.md)
  `CVE-2025-62753` · CVE record: MadrasThemes MAS Videos · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress Lekker theme <= 1.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69034.md)
  `CVE-2025-69034` · CVE record: Mikado-Themes Lekker · CVSS 8.1 High · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68996.md)
  `CVE-2025-68996` · CVE record: WebCodingPlace Responsive Posts Carousel Pro · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress Cinerama theme <= 2.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68987.md)
  `CVE-2025-68987` · CVE record: Edge-Themes Cinerama · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress Aora theme <= 1.3.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68985.md)
  `CVE-2025-68985` · CVE record: thembay Aora · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress Puca theme <= 2.6.39 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68984.md)
  `CVE-2025-68984` · CVE record: thembay Puca · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress Greenmart theme <= 4.2.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68983.md)
  `CVE-2025-68983` · CVE record: thembay Greenmart · CVSS 7.5 High · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68974.md)
  `CVE-2025-68974` · CVE record: miniOrange WordPress Social Login and Register · CVSS 6.6 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: File inclusion
- [WordPress CookieHint WP plugin <= 1.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68870.md)
  `CVE-2025-68870` · CVE record: reDim GmbH CookieHint WP · CVSS 7.5 High · Not analysed yet · Published 29 Dec 2025 · Tags: File inclusion
- [WordPress CedCommerce Integration for Good Market plugin <= 1.0.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68877.md)
  `CVE-2025-68877` · CVE record: cedcommerce CedCommerce Integration for Good Market · CVSS 7.5 High · Not analysed yet · Published 29 Dec 2025 · Tags: File inclusion
- [WordPress Docket Cache plugin <= 24.07.03 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68506.md)
  `CVE-2025-68506` · CVE record: Nawawi Jamili Docket Cache · CVSS 8.1 High · Not analysed yet · Published 24 Dec 2025 · Tags: File inclusion
- [WordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68563.md)
  `CVE-2025-68563` · CVE record: WP Shuffle Subscribe to Unlock Lite · CVSS 7.5 High · Not analysed yet · Published 24 Dec 2025 · Tags: File inclusion
- [WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68540.md)
  `CVE-2025-68540` · CVE record: thembay Fana · CVSS 7.5 High · Not analysed yet · Published 24 Dec 2025 · Tags: File inclusion
- [WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68537.md)
  `CVE-2025-68537` · CVE record: thembay Zota · CVSS 7.5 High · Not analysed yet · Published 24 Dec 2025 · Tags: File inclusion
- [WordPress Bookory theme <= 2.2.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68530.md)
  `CVE-2025-68530` · CVE record: pavothemes Bookory · CVSS 7.5 High · Not analysed yet · Published 24 Dec 2025 · Tags: File inclusion
- [CMSimple 5.4 Authenticated Local File Inclusion Remote Code Execution](https://agentprime.io/advisories/CVE-2021-47734.md)
  `CVE-2021-47734` · CVE record: Cmsimple CMSimple · CVSS 8.6 High · Not analysed yet · Published 23 Dec 2025 · Tags: File inclusion
- [WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68546.md)
  `CVE-2025-68546` · CVE record: thembay Nika · CVSS 7.5 High · Not analysed yet · Published 23 Dec 2025 · Tags: File inclusion
- [WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68544.md)
  `CVE-2025-68544` · CVE record: thembay Diza · CVSS 7.5 High · Not analysed yet · Published 23 Dec 2025 · Tags: File inclusion
- [WordPress TheGem Theme Elements (for Elementor) plugin <= 5.10.5.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68560.md)
  `CVE-2025-68560` · CVE record: CodexThemes TheGem Theme Elements (for Elementor) · CVSS 7.5 High · Not analysed yet · Published 23 Dec 2025 · Tags: File inclusion
- [A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper handling of user-supplied request parameters in the RestFil…](https://agentprime.io/advisories/CVE-2025-68645.md)
  `CVE-2025-68645` · CVE record · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.51 · Not analysed yet · Published 22 Dec 2025 · Tags: File inclusion
- [Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'](https://agentprime.io/advisories/CVE-2025-13641.md)
  `CVE-2025-13641` · CVE record: smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery · CVSS 8.8 High · Not analysed yet · Published 18 Dec 2025 · Tags: File inclusion
- [WordPress ListingPro theme < 2.9.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-64377.md)
  `CVE-2025-64377` · CVE record: CridioStudio ListingPro · CVSS 8.1 High · Not analysed yet · Published 18 Dec 2025 · Tags: File inclusion
- [WordPress Traveler theme < 3.2.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-64373.md)
  `CVE-2025-64373` · CVE record: shinetheme Traveler · CVSS 8.1 High · Not analysed yet · Published 18 Dec 2025 · Tags: File inclusion
- [WordPress PenNews theme < 6.7.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-64223.md)
  `CVE-2025-64223` · CVE record: PenciDesign PenNews · CVSS 8.1 High · Not analysed yet · Published 18 Dec 2025 · Tags: File inclusion
- [WordPress Jannah theme <= 7.6.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-64205.md)
  `CVE-2025-64205` · CVE record: TieLabs Jannah · CVSS 8.1 High · Not analysed yet · Published 18 Dec 2025 · Tags: File inclusion
- [WordPress XStore theme < 9.6.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-64193.md)
  `CVE-2025-64193` · CVE record: 8theme XStore · CVSS 7.5 High · Not analysed yet · Published 18 Dec 2025 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI1LTEyLTE4VDA3OjIyOjEwLjg3OTAwMFoiLCJDVkUtMjAyNS02NDE5MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI2LTAxLTIyVDE2OjUxOjUyLjkzMTAwMFoiLCJDVkUtMjAyNS02NzkzOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI2LTAxLTIyVDE2OjUxOjUyLjkzMTAwMFoiLCJDVkUtMjAyNS02NzkzOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.