# File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)](https://agentprime.io/advisories/GHSA-8fw8-q79c-fp9m.md)
  `GHSA-8fw8-q79c-fp9m`, `CVE-2026-33513`, `PKSA-2x5y-pg7k-8jx1` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: Path traversal, File inclusion
- [Uptime Kuma: SSTI in Notification Templates Allows Arbitrary File Read (Incomplete Fix for GHSA-vffh-c9pq-4crh)](https://agentprime.io/advisories/CVE-2026-33130.md)
  `CVE-2026-33130` · CVE record: louislam uptime-kuma · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: File inclusion, Code injection
- [WordPress Melania theme <= 2.5.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-22324.md)
  `CVE-2026-22324` · CVE record: ThemeREX Melania · CVSS 8.1 High · Not analysed yet · Published 20 Mar 2026 · Tags: File inclusion
- [WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27065.md)
  `CVE-2026-27065` · CVE record: ThimPress BuilderPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: File inclusion
- [WordPress Tripgo theme < 1.5.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-27093.md)
  `CVE-2026-27093` · CVE record: ovatheme Tripgo · CVSS 8.1 High · Not analysed yet · Published 19 Mar 2026 · Tags: File inclusion
- [Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion](https://agentprime.io/advisories/CVE-2026-1463.md)
  `CVE-2026-1463` · CVE record: smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery · CVSS 8.8 High · Not analysed yet · Published 18 Mar 2026 · Tags: File inclusion
- [A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure.](https://agentprime.io/advisories/CVE-2026-29858.md)
  `CVE-2026-29858` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2026 · Tags: File inclusion
- [LAM has Authenticated Local File Inclusion (LFI) in PDF export](https://agentprime.io/advisories/CVE-2026-27894.md)
  `CVE-2026-27894` · CVE record: LDAPAccountManager lam · CVSS 8.8 High · Not analysed yet · Published 17 Mar 2026 · Tags: File inclusion
- [WordPress Medilazar Core plugin < 1.4.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32426.md)
  `CVE-2026-32426` · CVE record: themelexus Medilazar Core · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32401.md)
  `CVE-2026-32401` · CVE record: BoldGrid Client Invoicing by Sprout Invoices · CVSS 7.2 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WordPress Boldman theme <= 7.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32400.md)
  `CVE-2026-32400` · CVE record: ThemetechMount Boldman · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WordPress Greenly Theme Addons plugin < 8.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32393.md)
  `CVE-2026-32393` · CVE record: Creatives_Planet Greenly Theme Addons · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WordPress Greenly theme <= 8.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32392.md)
  `CVE-2026-32392` · CVE record: Creatives_Planet Greenly · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WordPress WpBookingly plugin <= 1.2.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32384.md)
  `CVE-2026-32384` · CVE record: magepeopleteam WpBookingly · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WordPress Medilink-Core plugin < 2.0.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32369.md)
  `CVE-2026-32369` · CVE record: RadiusTheme Medilink-Core · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WordPress Turbo Manager plugin < 4.0.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-32364.md)
  `CVE-2026-32364` · CVE record: redqteam Turbo Manager · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: File inclusion
- [WellChoose｜IFTOP - Local File Inclusion](https://agentprime.io/advisories/CVE-2026-3826.md)
  `CVE-2026-3826` · CVE record: WellChoose IFTOP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Mar 2026 · Tags: File inclusion
- [WordPress Little Birdies theme <= 1.3.16 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28129.md)
  `CVE-2026-28129` · CVE record: axiomthemes Little Birdies · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28128.md)
  `CVE-2026-28128` · CVE record: ThemeREX Verse · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Midi theme <= 1.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28125.md)
  `CVE-2026-28125` · CVE record: AncoraThemes Midi · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Notarius theme <= 1.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28124.md)
  `CVE-2026-28124` · CVE record: AncoraThemes Notarius · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Veil theme <= 1.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28123.md)
  `CVE-2026-28123` · CVE record: AncoraThemes Veil · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Anderson theme <= 1.4.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28121.md)
  `CVE-2026-28121` · CVE record: AncoraThemes Anderson · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28120.md)
  `CVE-2026-28120` · CVE record: ThemeREX Dr.Patterson · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Nirvana theme <= 2.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28119.md)
  `CVE-2026-28119` · CVE record: axiomthemes Nirvana · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Welldone theme <= 2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28118.md)
  `CVE-2026-28118` · CVE record: axiomthemes Welldone · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress smart SEO theme <= 2.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28117.md)
  `CVE-2026-28117` · CVE record: axiomthemes smart SEO · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Muzicon theme <= 1.9.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28107.md)
  `CVE-2026-28107` · CVE record: ThemeREX Muzicon · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28098.md)
  `CVE-2026-28098` · CVE record: ThemeREX Save Life · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28097.md)
  `CVE-2026-28097` · CVE record: ThemeREX Artrium · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28096.md)
  `CVE-2026-28096` · CVE record: ThemeREX WealthCo · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Marcell theme <= 1.2.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28095.md)
  `CVE-2026-28095` · CVE record: ThemeREX Marcell · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress RexCoin theme <= 1.2.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28094.md)
  `CVE-2026-28094` · CVE record: ThemeREX RexCoin · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Ozisti theme <= 1.1.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28093.md)
  `CVE-2026-28093` · CVE record: ThemeREX Ozisti · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Sounder theme <= 1.3.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28092.md)
  `CVE-2026-28092` · CVE record: ThemeREX Sounder · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Coleo theme <= 1.1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28091.md)
  `CVE-2026-28091` · CVE record: ThemeREX Coleo · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Gamezone theme <= 1.1.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28090.md)
  `CVE-2026-28090` · CVE record: ThemeREX Gamezone · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Daiquiri theme <= 1.2.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28089.md)
  `CVE-2026-28089` · CVE record: ThemeREX Daiquiri · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Aqualots theme <= 1.1.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28088.md)
  `CVE-2026-28088` · CVE record: ThemeREX Aqualots · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Filmax theme <= 1.1.11 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28087.md)
  `CVE-2026-28087` · CVE record: ThemeREX Filmax · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Run Gran theme <= 2.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28086.md)
  `CVE-2026-28086` · CVE record: ThemeREX Run Gran · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Mahogany theme <= 2.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28085.md)
  `CVE-2026-28085` · CVE record: ThemeREX Mahogany · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Bazinga theme <= 1.1.9 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28084.md)
  `CVE-2026-28084` · CVE record: ThemeREX Bazinga · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Windsor theme <= 2.5.0 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28081.md)
  `CVE-2026-28081` · CVE record: ThemeREX Windsor · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Conquerors theme <= 1.2.13 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28079.md)
  `CVE-2026-28079` · CVE record: axiomthemes Conquerors · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Vapester theme <= 1.1.10 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28077.md)
  `CVE-2026-28077` · CVE record: ThemeREX Vapester · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Le Truffe theme <= 1.1.7 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28069.md)
  `CVE-2026-28069` · CVE record: ThemeREX Le Truffe · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Rhythmo theme <= 1.3.4 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28068.md)
  `CVE-2026-28068` · CVE record: ThemeREX Rhythmo · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Bassein theme <= 1.0.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28067.md)
  `CVE-2026-28067` · CVE record: ThemeREX Bassein · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Legrand theme <= 2.17 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28066.md)
  `CVE-2026-28066` · CVE record: ThemeREX Legrand · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Eject theme <= 2.17 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28065.md)
  `CVE-2026-28065` · CVE record: ThemeREX Eject · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Edge Decor theme <= 2.2 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28064.md)
  `CVE-2026-28064` · CVE record: ThemeREX Edge Decor · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Asia Garden theme <= 1.3.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28063.md)
  `CVE-2026-28063` · CVE record: ThemeREX Asia Garden · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Happy Baby theme <= 1.2.12 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28062.md)
  `CVE-2026-28062` · CVE record: ThemeREX Happy Baby · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Tiger Claw theme <= 1.1.14 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28061.md)
  `CVE-2026-28061` · CVE record: ThemeREX Tiger Claw · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress S.King theme <= 1.5.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28060.md)
  `CVE-2026-28060` · CVE record: ThemeREX S.King · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Dermatology Clinic theme <= 1.4.3 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28059.md)
  `CVE-2026-28059` · CVE record: ThemeREX Dermatology Clinic · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Dixon theme <= 1.4.2.1 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28058.md)
  `CVE-2026-28058` · CVE record: ThemeREX Dixon · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress Mandala theme <= 2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28057.md)
  `CVE-2026-28057` · CVE record: ThemeREX Mandala · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion
- [WordPress MCKinney's Politics theme <= 1.2.8 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-28056.md)
  `CVE-2026-28056` · CVE record: ThemeREX MCKinney's Politics · CVSS 8.1 High · Not analysed yet · Published 5 Mar 2026 · Tags: File inclusion

Newest: <https://agentprime.io/advisories/tag/file-inclusion.md>
Older: <https://agentprime.io/advisories/tag/file-inclusion.md?cursor=WyIyMDI2LTAzLTA1VDA1OjU0OjE3Ljc0MzAwMFoiLCJDVkUtMjAyNi0yODA1NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=file-inclusion&cursor=WyIyMDI2LTAzLTI1VDE2OjE0OjIzLjEzNTAwMFoiLCJDVkUtMjAyNi0yMjQ5MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/file-inclusion/?cursor=WyIyMDI2LTAzLTI1VDE2OjE0OjIzLjEzNTAwMFoiLCJDVkUtMjAyNi0yMjQ5MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.