Advisories · Weakness

File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-71550 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

SuiteCRM: LFI to RCE via AOW_WorkFlow
- SuiteCRM
- File inclusion
Not analysed yet 5 Nov 2026
CVE-2026-73695 CVE record

CVSS 8.7 High

Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
- Control Web Panel
- File inclusion
Not analysed yet 2 Nov 2026
CVE-2026-62121 CVE record

CVSS 6.5 Medium

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Local File Inclusion vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- File inclusion
Not analysed yet 30 Oct 2026
CVE-2010-20125 CVE record

CVSS 8.7 High

DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php
- DedeCMS
- File inclusion
Not analysed yet 30 Oct 2026
CVE-2026-110185 CVE record

CVSS 5.9 Medium

Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parameters
- bitpressadmin Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More
- File inclusion
Not analysed yet 28 Oct 2026
CVE-2014-125137 CVE record

CVSS 7.1 High

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php
- C97net qEngine CMS
- C97net Kemana Directory
- File inclusion
Not analysed yet 28 Oct 2026
CVE-2026-112850 CVE record

CVSS 8.1 High

WordPress Your Dress theme <= 1.4.1 - Local File Inclusion vulnerability
- AncoraThemes Your Dress
- File inclusion
Not analysed yet 23 Oct 2026
CVE-2026-112832 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
- CozyThemes Rootblox
- File inclusion
Not analysed yet 22 Oct 2026
CVE-2017-20289 CVE record

CVSS 7.7 High

Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter
- Broadstreet Ad Widget
- File inclusion
Not analysed yet 22 Oct 2026
CVE-2026-112820 CVE record

CVSS 8.1 High

WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability
- Elated-Themes Academist Core
- File inclusion
Not analysed yet 22 Oct 2026
CVE-2016-20101 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php
- Pedro Marcelo Issuu Panel
- File inclusion
Not analysed yet 20 Oct 2026
CVE-2026-113402 CVE record

CVSS 7.1 High

ArmorX Global Technology｜ArmorX Spam - Local File Inclusion
- ArmorX Global Technology ArmorX Spam
- File inclusion
Not analysed yet 20 Oct 2026
CVE-2026-111829 CVE record

CVSS 6.5 Medium

WordPress WP Mailster plugin <= 1.9.1.0 - Local File Inclusion vulnerability
- WP Mailster
- File inclusion
Not analysed yet 19 Oct 2026
yourls/yourls Packagist

CVSS 5.3 Medium

YOURLS: Unauthenticated File Inclusion
- File inclusion
<1.10.5 · fixed in 1.10.5

GHSA-f8ff-652m-j5rx · CVE-2026-62858 Not analysed yet 15 Oct 2026
CVE-2026-104909 CVE record

CVSS 8.1 High

Mang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter
- kitae-park Mang Board
- File inclusion
Not analysed yet 14 Oct 2026
CVE-2026-110284 CVE record

CVSS 7.5 High

LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
- LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- File inclusion
Not analysed yet 14 Oct 2026
CVE-2026-103367 CVE record

CVSS 8.1 High

ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
- wpdesk ShopMagic – email automation for WordPress
- File inclusion
Not analysed yet 14 Oct 2026
CVE-2026-104995 CVE record

CVSS 8.1 High

BP Profile Search <= 5.9 - Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value
- dontdream BP Profile Search
- File inclusion
Not analysed yet 14 Oct 2026
CVE-2026-66566 CVE record

CVSS 8.1 High

WordPress Ambient theme <= 1.7 - Local File Inclusion vulnerability
- Elated-Themes Ambient
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62115 CVE record

CVSS 8.1 High

WordPress KuteShop theme <= 4.2.9 - Local File Inclusion vulnerability
- kutethemes KuteShop
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62099 CVE record

CVSS 8.1 High

WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability
- kutethemes Boutique
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62096 CVE record

CVSS 8.1 High

WordPress Biolife theme <= 3.2.3 - Local File Inclusion vulnerability
- kutethemes Biolife
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62094 CVE record

CVSS 8.1 High

WordPress TechOne theme <= 3.0.3 - Local File Inclusion vulnerability
- kutethemes TechOne
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62092 CVE record

CVSS 8.1 High

WordPress Armania theme <= 1.4.8 - Local File Inclusion vulnerability
- kutethemes Armania
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62075 CVE record

CVSS 8.1 High

WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability
- Mymoun Backhoe
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62074 CVE record

CVSS 8.1 High

WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability
- ThemeREX Ozeum
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62070 CVE record

CVSS 8.1 High

WordPress Flipmart theme <= 2.8 - Local File Inclusion vulnerability
- CKThemes Flipmart
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62069 CVE record

CVSS 8.1 High

WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability
- CocoBasic Fabius
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62068 CVE record

CVSS 8.1 High

WordPress Teoro theme <= 1.1 - Local File Inclusion vulnerability
- CocoBasic Teoro
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62067 CVE record

CVSS 8.1 High

WordPress Kaven theme <= 1.2 - Local File Inclusion vulnerability
- CocoBasic Kaven
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62066 CVE record

CVSS 8.1 High

WordPress Volos theme <= 1.2 - Local File Inclusion vulnerability
- CocoBasic Volos
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62065 CVE record

CVSS 8.1 High

WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability
- CocoBasic Cardea
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62032 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress DirectoryPress plugin <= 3.6.27 - Local File Inclusion vulnerability
- Designinvento DirectoryPress
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-62020 CVE record

CVSS 8.1 High

WordPress TouchUp theme < 1.4 - Local File Inclusion vulnerability
- Mikado-Themes TouchUp
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-48194 CVE record

CVSS 8.1 High

WordPress DukaMarket theme <= 1.3.0 - Local File Inclusion vulnerability
- kutethemes DukaMarket
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-48193 CVE record

CVSS 8.1 High

WordPress Uminex theme <= 1.0.9 - Local File Inclusion vulnerability
- kutethemes Uminex
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-42777 CVE record

CVSS 8.1 High

WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability
- Edge-Themes Aalto
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-42724 CVE record

CVSS 8.1 High

WordPress CleanSkin theme <= 1.5.0 - Local File Inclusion vulnerability
- AncoraThemes CleanSkin
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-42704 CVE record

CVSS 8.1 High

WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability
- axiomthemes Kids Care
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-104899 CVE record

CVSS 8.1 High

GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- File inclusion
Not analysed yet 10 Oct 2026
CVE-2026-94067 CVE record

CVSS 8.1 High

WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability
- Fuelthemes The Voux
- File inclusion
Not analysed yet 9 Oct 2026
CVE-2026-94062 CVE record

CVSS 8.1 High

WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability
- Fuelthemes Werkstatt
- File inclusion
Not analysed yet 9 Oct 2026
CVE-2026-75028 CVE record

CVSS 7.5 High

WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
- arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
- File inclusion
Not analysed yet 3 Oct 2026
CVE-2026-92174 CVE record

CVSS 7.5 High

SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter
- gpriday SiteOrigin Widgets Bundle
- File inclusion
Not analysed yet 2 Oct 2026
CVE-2026-71426 CVE record

CVSS 7.1 High

GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field
- GetSimpleCMS-CE
- Path traversal
- File inclusion
Not analysed yet 1 Oct 2026
CVE-2026-96837 CVE record

CVSS 8.8 High

WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability
- Brainstorm Force CartFlows
- File inclusion
Not analysed yet 30 Sept 2026
CVE-2026-89294 CVE record

CVSS 7.5 High

Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
- croixhaug Simply Schedule Appointments
- File inclusion
Not analysed yet 30 Sept 2026
CVE-2026-49850 CVE record

CVSS 7.5 High

InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
- InvoicePlane
- Path traversal
- File inclusion
Not analysed yet 25 Sept 2026
CVE-2026-50547 CVE record

CVSS 7.5 High

InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
- InvoicePlane
- Path traversal
- File inclusion
Not analysed yet 25 Sept 2026
CVE-2026-39353 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

InvoicePlane: Remote Code Execution via Writable Templates Directory
- InvoicePlane
- File inclusion
- Broken access control
Not analysed yet 25 Sept 2026
CVE-2026-13456 CVE record

CVSS 7.5 High

WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter
- flippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
- File inclusion
Not analysed yet 25 Sept 2026
CVE-2026-12227 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter
- visualcomposer Visual Composer Website Builder
- File inclusion
Not analysed yet 24 Sept 2026
CVE-2026-87902 CVE record

CVSS 8.1 HighCritical · KEV, CVSS 7+ and EPSSKEV

PHP file inclusion in WordPress
- WordPress
- File inclusion
Not analysed yet 22 Sept 2026
CVE-2026-9231 CVE record

CVSS 7.5 High

WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
- wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software
- File inclusion
Not analysed yet 22 Sept 2026
CVE-2026-92969 CVE record

CVSS 8.1 High

HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
- realmag777 HUSKY – Products Filter for WooCommerce Professional
- File inclusion
Not analysed yet 22 Sept 2026
CVE-2026-88994 CVE record

CVSS 6.6 Medium

All Bootstrap Blocks 1.3.20 - 1.3.31 - Contributor+ LFI via lightspeed Block Attributes
- All Bootstrap Blocks
- File inclusion
Not analysed yet 18 Sept 2026
CVE-2026-27556 CVE record

CVSS 8.8 High

Local File Inclusion in /index.php/ajax/save_iodd_parameters
- Pepperl+Fuchs ICE2-8IOL1-G65L-V1D
- Pepperl+Fuchs ICE2-8IOL-G65L-V1D
- File inclusion
Not analysed yet 16 Sept 2026
CVE-2026-27555 CVE record

CVSS 8.8 High

Local File Inclusion in /index.php/ajax/get_iodd_port_info
- Pepperl+Fuchs ICE2-8IOL1-G65L-V1D
- Pepperl+Fuchs ICE2-8IOL-G65L-V1D
- File inclusion
Not analysed yet 16 Sept 2026
CVE-2026-85200 CVE record

CVSS 7.5 High

GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
- ninjew GEO my WP
- File inclusion
Not analysed yet 12 Sept 2026
CVE-2026-87927 CVE record

CVSS 8.8 High

MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
- MaxSite CMS
- File inclusion
Not analysed yet 9 Sept 2026