# File inclusion. A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress UnlimHost theme <= 1.2.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22380.md) `CVE-2026-22380` · CVE record: AncoraThemes UnlimHost · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Netmix theme <= 1.0.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22379.md) `CVE-2026-22379` · CVE record: AncoraThemes Netmix · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22378.md) `CVE-2026-22378` · CVE record: AncoraThemes Blabber · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Saveo theme <= 1.1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22377.md) `CVE-2026-22377` · CVE record: AncoraThemes Saveo · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Parkivia theme <= 1.1.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22376.md) `CVE-2026-22376` · CVE record: AncoraThemes Parkivia · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Impacto Patronus theme <= 1.2.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22375.md) `CVE-2026-22375` · CVE record: AncoraThemes Impacto Patronus · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Zio Alberto theme <= 1.2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22374.md) `CVE-2026-22374` · CVE record: AncoraThemes Zio Alberto · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Fooddy theme <= 1.3.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22373.md) `CVE-2026-22373` · CVE record: AncoraThemes Fooddy · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Isida theme <= 1.4.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22372.md) `CVE-2026-22372` · CVE record: AncoraThemes Isida · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Gustavo theme <= 1.2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22371.md) `CVE-2026-22371` · CVE record: AncoraThemes Gustavo · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Marveland theme <= 1.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22370.md) `CVE-2026-22370` · CVE record: axiomthemes Marveland · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Ironfit theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22369.md) `CVE-2026-22369` · CVE record: AncoraThemes Ironfit · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Redy theme <= 1.0.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22368.md) `CVE-2026-22368` · CVE record: axiomthemes Redy · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22367.md) `CVE-2026-22367` · CVE record: AncoraThemes Coworking · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Jude theme <= 1.3.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22366.md) `CVE-2026-22366` · CVE record: axiomthemes Jude · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Soleng theme <= 1.0.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22365.md) `CVE-2026-22365` · CVE record: axiomthemes Soleng · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress SevenTrees theme <=1.0.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22364.md) `CVE-2026-22364` · CVE record: axiomthemes SevenTrees · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Rhodos theme <= 1.3.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22363.md) `CVE-2026-22363` · CVE record: axiomthemes Rhodos · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Photolia theme <= 1.0.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22362.md) `CVE-2026-22362` · CVE record: axiomthemes Photolia · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress A-Mart theme <= 1.0.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22361.md) `CVE-2026-22361` · CVE record: axiomthemes A-Mart · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22356.md) `CVE-2026-22356` · CVE record: Automattic Jetpack CRM · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22344.md) `CVE-2026-22344` · CVE record: Mikado-Themes FiveStar · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69410.md) `CVE-2025-69410` · CVE record: Edge-Themes Belletrist · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress PJ | Life & Business Coaching theme <= 3.0.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69409.md) `CVE-2025-69409` · CVE record: axiomthemes PJ | Life & Business Coaching · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress HealthFirst theme <= 1.0.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69408.md) `CVE-2025-69408` · CVE record: Mikado-Themes HealthFirst · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69407.md) `CVE-2025-69407` · CVE record: Select-Themes Struktur · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69406.md) `CVE-2025-69406` · CVE record: ThemeREX FreightCo · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress R&F theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69402.md) `CVE-2025-69402` · CVE record: ThemeREX R&F · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69400.md) `CVE-2025-69400` · CVE record: ThemeREX Yokoo · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Cobble theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69399.md) `CVE-2025-69399` · CVE record: ThemeREX Cobble · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Plank theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69398.md) `CVE-2025-69398` · CVE record: ThemeREX Plank · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Tint theme <= 1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69397.md) `CVE-2025-69397` · CVE record: ThemeREX Tint · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Splendour theme <= 1.23 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69396.md) `CVE-2025-69396` · CVE record: ThemeREX Splendour · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Gable theme <= 1.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69395.md) `CVE-2025-69395` · CVE record: ThemeREX Gable · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Simple Retail Menus plugin <= 4.2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69387.md) `CVE-2025-69387` · CVE record: whatwouldjessedo Simple Retail Menus · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress WP shop plugin <= 2.6.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69383.md) `CVE-2025-69383` · CVE record: Agence web Eoxia - Montpellier WP shop · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Portfolio Builder plugin <= 1.2.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69375.md) `CVE-2025-69375` · CVE record: SolverWp Portfolio Builder · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69374.md) `CVE-2025-69374` · CVE record: SolverWp Eleblog – Elementor Blog And Magazine Addons · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress VidoRev theme <= 2.9.9.9.9.9.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69373.md) `CVE-2025-69373` · CVE record: beeteam368 VidoRev · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress PeakShops theme < 1.5.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-69322.md) `CVE-2025-69322` · CVE record: fuelthemes PeakShops · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68841.md) `CVE-2025-68841` · CVE record: Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68552.md) `CVE-2025-68552` · CVE record: WebCodingPlace WooCommerce Coming Soon Product with Countdown · CVSS 7.5 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68545.md) `CVE-2025-68545` · CVE record: thembay Nika · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68543.md) `CVE-2025-68543` · CVE record: thembay Diza · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68539.md) `CVE-2025-68539` · CVE record: thembay Fana · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-68536.md) `CVE-2025-68536` · CVE record: thembay Zota · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress PatioTime theme < 2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67992.md) `CVE-2025-67992` · CVE record: LoftOcean PatioTime · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67988.md) `CVE-2025-67988` · CVE record: LoftOcean CozyStay · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67982.md) `CVE-2025-67982` · CVE record: thembay Urna · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67981.md) `CVE-2025-67981` · CVE record: thembay Besa · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-67980.md) `CVE-2025-67980` · CVE record: thembay Hara · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Extensive VC Addons for WPBakery page builder plugin <= 1.9.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2025-60087.md) `CVE-2025-60087` · CVE record: Nenad Obradovic Extensive VC Addons for WPBakery page builder · CVSS 8.1 High · Not analysed yet · Published 20 Feb 2026 · Tags: File inclusion - [WordPress Airtifact theme <= 1.2.91 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27343.md) `CVE-2026-27343` · CVE record: VanKarWai Airtifact · CVSS 7.5 High · Not analysed yet · Published 19 Feb 2026 · Tags: File inclusion - [WordPress Sales Countdown Timer for WooCommerce and WordPress plugin < 1.1.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27052.md) `CVE-2026-27052` · CVE record: villatheme Sales Countdown Timer for WooCommerce and WordPress · CVSS 7.5 High · Not analysed yet · Published 19 Feb 2026 · Tags: File inclusion - [WordPress CMSMasters Content Composer plugin <= 1.4.5 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25326.md) `CVE-2026-25326` · CVE record: cmsmasters CMSMasters Content Composer · CVSS 7.5 High · Not analysed yet · Published 19 Feb 2026 · Tags: File inclusion - [Prodigy Commerce <= 3.3.0 - Unauthenticated Local File Inclusion via parameters\[template_name\]](https://agentprime.io/advisories/CVE-2026-0926.md) `CVE-2026-0926` · CVE record: prodigycommerce Prodigy Commerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2026 · Tags: File inclusion - [InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning](https://agentprime.io/advisories/CVE-2026-25548.md) `CVE-2026-25548` · CVE record: InvoicePlane InvoicePlane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2026 · Tags: Code injection, File inclusion, Other injection - [Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-1988.md) `CVE-2026-1988` · CVE record: wpdecent Flexi Product Slider and Grid for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 14 Feb 2026 · Tags: File inclusion - [SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode](https://agentprime.io/advisories/CVE-2025-15368.md) `CVE-2025-15368` · CVE record: themeboy SportsPress – Sports Club & League Manager · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: File inclusion - [WordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-25027.md) `CVE-2026-25027` · CVE record: ThemeMove Unicamp · CVSS 7.5 High · Not analysed yet · Published 3 Feb 2026 · Tags: File inclusion Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .