Advisories · Weakness

File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-26760 CVE record

CVSS 7.5 High

WordPress Calculator Builder plugin <= 1.6.2 - Local File Inclusion vulnerability
- Wow-Company Calculator Builder
- File inclusion
Not analysed yet 22 Feb 2025
CVE-2025-26757 CVE record

CVSS 7.5 High

WordPress FULL – Cliente plugin <= 3.1.26 - Local File Inclusion vulnerability
- FULL SERVICES FULL Customer
- File inclusion
Not analysed yet 22 Feb 2025
CVE-2024-13353 CVE record

CVSS 8.8 High

Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion
- cyberchimps Responsive Addons for Elementor – Free Elementor Addons, Kits and Elementor Templates
- File inclusion
Not analysed yet 21 Feb 2025
CVE-2024-13592 CVE record

CVSS 7.5 High

Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Local File Inclusion
- labibahmed42 Team Builder For WPBakery Page Builder(Formerly Visual Composer)
- File inclusion
Not analysed yet 19 Feb 2025
CVE-2025-22656 CVE record

CVSS 8.1 High

WordPress Cookie Monster Plugin <= 1.2.2 - Local File Inclusion vulnerability
- Oscar Alvarez Cookie Monster
- File inclusion
Not analysed yet 18 Feb 2025
CVE-2025-25141 CVE record

CVSS 7.5 High

WordPress Fami Sales Popup plugin <= 2.0.0 - Local File Inclusion vulnerability
- zankover Fami Sales Popup
- File inclusion
Not analysed yet 7 Feb 2025
CVE-2024-12859 CVE record

CVSS 8.8 High

BoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- PX-lab BoomBox Theme Extensions
- File inclusion
Not analysed yet 3 Feb 2025
CVE-2025-0366 CVE record

CVSS 8.8 High

Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)
- artbees Jupiter X Core
- File inclusion
Not analysed yet 1 Feb 2025
CVE-2025-24782 CVE record

CVSS 6.5 Medium

WordPress Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin <= 1.6.10 - Local File Inclusion vulnerability
- wpWax Post Grid, Slider & Carousel Ultimate
- File inclusion
Not analysed yet 27 Jan 2025
CVE-2025-0682 CVE record

CVSS 8.8 High

ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- ThemeREX Addons
- File inclusion
Not analysed yet 25 Jan 2025
CVE-2025-24733 CVE record

CVSS 6.5 Medium

WordPress Post Grid Master plugin <= 3.4.12 - Local File Inclusion vulnerability
- Akhtarujjaman Shuvo Post Grid Master
- File inclusion
Not analysed yet 24 Jan 2025
CVE-2024-45077 CVE record

CVSS 6.5 Medium

IBM Maximo Asset Management file upload
- IBM Maximo Asset Management
- File inclusion
Not analysed yet 24 Jan 2025
CVE-2024-13408 CVE record

CVSS 7.5 High

Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion
- wpwax Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget
- File inclusion
Not analysed yet 24 Jan 2025
CVE-2024-13593 CVE record

CVSS 7.5 High

BMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion
- otrok7 BMLT Meeting Map
- File inclusion
Not analysed yet 23 Jan 2025
CVE-2025-23949 CVE record

CVSS 8.1 High

WordPress Improved Sale Badges – Free Version Plugin <= 1.0.1 - Local File Inclusion vulnerability
- dzeriho Improved Sale Badges – Free Version
- File inclusion
Not analysed yet 22 Jan 2025
CVE-2025-23948 CVE record

CVSS 8.1 High

WordPress Background animation blocks Plugin <= 2.1.5 - Local File Inclusion vulnerability
- Webarea Background animation blocks
- File inclusion
Not analysed yet 22 Jan 2025
CVE-2025-23938 CVE record

CVSS 7.5 High

WordPress Image Gallery Box by CRUDLab Plugin <= 1.0.3 - Local File Inclusion vulnerability
- Image Gallery Box by CRUDLab
- File inclusion
Not analysed yet 22 Jan 2025
CVE-2025-22311 CVE record

CVSS 7.5 High

WordPress Private Messages for UserPro plugin <= 4.10.0 - Local File Inclusion vulnerability
- DeluxeThemes Private Messages for UserPro
- File inclusion
Not analysed yet 21 Jan 2025
CVE-2025-23915 CVE record

CVSS 7.5 High

WordPress FAT Event Lite plugin <= 1.1 - Authenticated Non-Arbitrary Local File Inclusion vulnerability
- roninwp FAT Event Lite
- File inclusion
Not analysed yet 16 Jan 2025
CVE-2025-22508 CVE record

CVSS 8.1 High

WordPress FAT Event Lite plugin <= 1.1 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability
- roninwp FAT Event Lite
- File inclusion
Not analysed yet 9 Jan 2025
nesbot/carbon Packagist

CVSS 6.3 Medium

Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
- File inclusion
<2.72.6 || >=3.0.0, <3.8.4 · fixed in 2.72.6, 3.8.4

GHSA-j3f9-p6hm-5w6q · CVE-2025-22145 Not analysed yet 8 Jan 2025
CVE-2024-53800 CVE record

CVSS 8.1 High

WordPress Rezgo Online Booking plugin <= 4.17 - Local File Inclusion vulnerability
- Rezgo
- File inclusion
Not analysed yet 7 Jan 2025
CVE-2024-49649 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability
- hakeemnala Build App Online
- File inclusion
Not analysed yet 7 Jan 2025
CVE-2024-56281 CVE record

CVSS 7.5 High

WordPress 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 plugin <= 5.2.0 - Local File Inclusion vulnerability
- codemstory 워드프레스 결제 심플페이
- File inclusion
Not analysed yet 7 Jan 2025
CVE-2024-56282 CVE record

CVSS 7.5 High

WordPress WPMozo Addons Lite for Elementor plugin <= 1.1.0 - Local File Inclusion vulnerability
- Elicus WPMozo Addons Lite for Elementor
- File inclusion
Not analysed yet 7 Jan 2025
CVE-2025-22305 CVE record

CVSS 6.5 Medium

WordPress Hero Banner Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability
- Essential Plugin Hero Banner Ultimate
- File inclusion
Not analysed yet 7 Jan 2025
CVE-2025-22364 CVE record

CVSS 7.5 High

WordPress Ach Invoice App plugin <= 1.0.1 - Local File Inclusion vulnerability
- Service Shogun Ach Invoice App
- File inclusion
Not analysed yet 7 Jan 2025
CVE-2024-56216 CVE record

CVSS 6.5 Medium

WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability
- themifyme Themify Builder
- File inclusion
Not analysed yet 31 Dec 2024
CVE-2024-56230 CVE record

CVSS 7.5 High

WordPress Dynamic Product Category Grid, Slider for WooCommerce plugin <= 1.1.3 - Local File Inclusion vulnerability
- Maidul Dynamic Product Category Grid, Slider for WooCommerce
- File inclusion
Not analysed yet 31 Dec 2024
CVE-2024-12272 CVE record

CVSS 8.8 High

WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion
- wptravelengine WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor
- File inclusion
Not analysed yet 25 Dec 2024
CVE-2024-12571 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion
- moaluko Store Locator for WordPress with Google Maps – LotsOfLocales
- File inclusion
Not analysed yet 20 Dec 2024
CVE-2024-54270 CVE record

CVSS 8.1 High

WordPress Axeptio plugin <= 2.5.4 - Local File Inclusion vulnerability
- Axeptio
- File inclusion
Not analysed yet 18 Dec 2024
CVE-2024-54376 CVE record

CVSS 7.5 High

WordPress EazyDocs plugin <= 2.8.0 - Local File Inclusion vulnerability
- Spider Themes EazyDocs
- File inclusion
Not analysed yet 16 Dec 2024
CVE-2024-12040 CVE record

CVSS 8.8 High

Product Carousel Slider & Grid Ultimate for WooCommerce <= 1.9.10 - Authenticated (Contributor+) Local File Inclusion via 'theme'
- wpwax Product Carousel Slider & Grid Ultimate for WooCommerce
- File inclusion
Not analysed yet 12 Dec 2024
CVE-2024-52385 CVE record

CVSS 4.3 Medium

WordPress Team Member – Multi Language Supported Team plugin <= 7.4 - Limited Local File Inclusion vulnerability
- wpmart Team Member
- File inclusion
Not analysed yet 9 Dec 2024
CVE-2024-54225 CVE record

CVSS 7.5 High

WordPress Designer plugin <= 1.4.1 - Local File Inclusion vulnerability
- codegearthemes Designer
- File inclusion
Not analysed yet 9 Dec 2024
CVE-2024-12209 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
- wphealth WP Umbrella: Update Backup Restore & Monitoring
- File inclusion
Not analysed yet 8 Dec 2024
CVE-2024-53824 CVE record

CVSS 7.5 High

WordPress All Bootstrap Blocks plugin <= 1.3.20 - Local File Inclusion vulnerability
- all_bootstrap_blocks All Bootstrap Blocks
- File inclusion
Not analysed yet 6 Dec 2024
CVE-2024-11289 CVE record

CVSS 8.1 High

Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion
- pencidesign Soledad
- File inclusion
Not analysed yet 6 Dec 2024
CVE-2024-51541 CVE record

CVSS 8.8 High

Local File Inclusion
- ABB ASPECT-Enterprise
- ABB NEXUS Series
- File inclusion
Not analysed yet 5 Dec 2024
CVE-2024-11429 CVE record

CVSS 8.8 High

Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials <= 3.3.3 - Authenticated (Contributor+) Local File Inclusion
- premio Stars Testimonials — Responsive Reviews & Star Ratings
- File inclusion
Not analysed yet 5 Dec 2024
CVE-2024-53739 CVE record

CVSS 8.1 High

WordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability
- Cool Plugins Cryptocurrency Widgets For Elementor
- File inclusion
Not analysed yet 30 Nov 2024
CVE-2024-52496 CVE record

CVSS 7.5 High

WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Local File Inclusion vulnerability
- AbsolutePlugins Absolute Addons For Elementor
- File inclusion
Not analysed yet 28 Nov 2024
CVE-2024-52497 CVE record

CVSS 7.5 High

WordPress Shopready plugin <= 3.6 - Local File Inclusion vulnerability
- quomodosoft Shopready
- File inclusion
Not analysed yet 28 Nov 2024
CVE-2024-52499 CVE record

CVSS 7.5 High

WordPress Pricing table addon for elementor plugin <= 1.0.0 - Local File Inclusion vulnerability
- Ibrahim Pricing table addon for elementor
- File inclusion
Not analysed yet 28 Nov 2024
CVE-2024-52501 CVE record

CVSS 7.5 High

WordPress Office Locator plugin <= 1.3.0 - Local File Inclusion vulnerability
- WebbyTemplate Office Locator
- File inclusion
Not analysed yet 28 Nov 2024
CVE-2024-10873 CVE record

CVSS 8.8 High

LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
- choijun LA-Studio Element Kit for Elementor
- File inclusion
Not analysed yet 23 Nov 2024
CVE-2024-10898 CVE record

CVSS 8.8 High

Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion
- krishaweb Email addon for CF7
- File inclusion
Not analysed yet 21 Nov 2024
CVE-2024-52450 CVE record

CVSS 7.5 High

WordPress nBlocks plugin <= 1.0.2 - Local File Inclusion vulnerability
- officialprocoders nBlocks
- File inclusion
Not analysed yet 20 Nov 2024
CVE-2024-52428 CVE record

CVSS 8.1 High

WordPress Ads Booster by Ads Pro plugin <= 1.12 - Local File Inclusion vulnerability
- Peter Ads Booster by Ads Pro
- File inclusion
Not analysed yet 18 Nov 2024
CVE-2024-52386 CVE record

CVSS 5.3 Medium

WordPress Classified Listing plugin <= 3.1.16 - Local File Inclusion vulnerability
- RadiusTheme Classified Listing
- File inclusion
Not analysed yet 16 Nov 2024
CVE-2024-52381 CVE record

CVSS 8.1 High

WordPress ZIJ KART plugin <= 1.1 - Local File Inclusion vulnerability
- Shoaib Rehmat ZIJ KART
- File inclusion
Not analysed yet 14 Nov 2024
CVE-2024-10571 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source
- ays-pro Chartify – WordPress Chart Plugin
- File inclusion
Not analysed yet 14 Nov 2024
CVE-2024-10871 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion
- trustyplugins Category AJAX Filter – Advanced Filter for Posts & Custom Post Types
- File inclusion
Not analysed yet 9 Nov 2024
CVE-2024-10436 CVE record

CVSS 8.8 High

WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion
- wpclever WPC Smart Messages for WooCommerce
- File inclusion
Not analysed yet 29 Oct 2024
CVE-2024-50434 CVE record

CVSS 7.5 High

WordPress NewsCard theme <= 1.3 - Local File Inclusion vulnerability
- themehorse NewsCard
- File inclusion
Not analysed yet 28 Oct 2024
CVE-2024-50435 CVE record

CVSS 7.5 High

WordPress Meta News theme <= 1.1.7 - Local File Inclusion vulnerability
- themehorse Meta News
- File inclusion
Not analysed yet 28 Oct 2024
CVE-2024-50436 CVE record

CVSS 7.5 High

WordPress Clean Retina theme <= 3.0.6 - Local File Inclusion vulnerability
- themehorse Clean Retina
- File inclusion
Not analysed yet 28 Oct 2024
CVE-2024-50457 CVE record

CVSS 7.5 High

WordPress Qode Essential Addons plugin <= 1.6.3 - Local File Inclusion vulnerability
- Qode Essential Addons
- File inclusion
Not analysed yet 28 Oct 2024
CVE-2024-50497 CVE record

CVSS 8.1 High

WordPress Advanced Online Ordering and Delivery Platform plugin <= 2.0.0 - Local File Inclusion vulnerability
- wdesco Advanced Online Ordering and Delivery Platform
- File inclusion
Not analysed yet 28 Oct 2024