Advisories · Weakness

File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2025-69163 CVE record

CVSS 8.1 High

WordPress WineShop theme <= 3.17 - Local File Inclusion vulnerability
- ThemeREX WineShop
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69162 CVE record

CVSS 8.1 High

WordPress Grecko theme <= 5.17 - Local File Inclusion vulnerability
- ThemeREX Grecko
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69160 CVE record

CVSS 8.1 High

WordPress Gita theme <= 1.11 - Local File Inclusion vulnerability
- ThemeREX Gita
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69159 CVE record

CVSS 8.1 High

WordPress Printo theme <= 1.11 - Local File Inclusion vulnerability
- ThemeREX Printo
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69150 CVE record

CVSS 8.1 High

WordPress Medeus theme <= 1.14 - Local File Inclusion vulnerability
- ThemeREX Medeus
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69149 CVE record

CVSS 8.1 High

WordPress Top Dog theme <= 1.0.5 - Local File Inclusion vulnerability
- ThemeREX Top Dog
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69147 CVE record

CVSS 8.1 High

WordPress Putter theme <= 1.17 - Local File Inclusion vulnerability
- ThemeREX Putter
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69146 CVE record

CVSS 8.1 High

WordPress Dom theme <= 1.24 - Local File Inclusion vulnerability
- ThemeREX Dom
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69143 CVE record

CVSS 8.1 High

WordPress Mission theme <= 1.22 - Local File Inclusion vulnerability
- ThemeREX Mission
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69142 CVE record

CVSS 8.1 High

WordPress Abelle theme <= 1.22 - Local File Inclusion vulnerability
- ThemeREX Abelle
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69141 CVE record

CVSS 8.1 High

WordPress Kelly Young theme <= 1.1.0 - Local File Inclusion vulnerability
- ThemeREX Kelly Young
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69136 CVE record

CVSS 8.1 High

WordPress Wanium theme <= 1.9.8 - Local File Inclusion vulnerability
- THEMELOGI Wanium
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69125 CVE record

CVSS 8.1 High

WordPress Food Drop theme <= 1.3 - Local File Inclusion vulnerability
- ThemeREX Food Drop
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69124 CVE record

CVSS 8.1 High

WordPress Especio theme <= 1.0 - Local File Inclusion vulnerability
- ThemeREX Especio
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69121 CVE record

CVSS 8.1 High

WordPress Deliciosa theme <= 1.10.0 - Local File Inclusion vulnerability
- ThemeREX Deliciosa
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69119 CVE record

CVSS 8.1 High

WordPress Corbesier theme <= 1.15.0 - Local File Inclusion vulnerability
- ThemeREX Corbesier
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69118 CVE record

CVSS 8.1 High

WordPress CopyPress theme <= 1.4.5 - Local File Inclusion vulnerability
- ThemeREX CopyPress
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69116 CVE record

CVSS 8.1 High

WordPress Iona theme <= 1.0.8 - Local File Inclusion vulnerability
- ThemeREX Iona
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69114 CVE record

CVSS 8.1 High

WordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability
- ThemeREX MaxiNet
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69113 CVE record

CVSS 8.1 High

WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability
- ThemeREX Nexio
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69112 CVE record

CVSS 8.1 High

WordPress Planty theme <= 1.14.0 - Local File Inclusion vulnerability
- ThemeREX Planty
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69109 CVE record

CVSS 8.1 High

WordPress Raider Spirit theme <= 1.1.2 - Local File Inclusion vulnerability
- ThemeREX Raider Spirit
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69107 CVE record

CVSS 8.1 High

WordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability
- ThemeREX Rosaleen
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-69105 CVE record

CVSS 8.1 High

WordPress Modernee theme <= 1.6.0 - Local File Inclusion vulnerability
- ThemeREX Modernee
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-60085 CVE record

CVSS 8.1 High

WordPress Learnify theme <= 1.15.0 - Local File Inclusion vulnerability
- ThemeREX Group Learnify
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2025-58924 CVE record

CVSS 8.1 High

WordPress Geya theme <= 1.15 - Local File Inclusion vulnerability
- ThemeREX Group Geya
- File inclusion
Not analysed yet 16 Jun 2026
CVE-2026-49954 CVE record

CVSS 8.6 High

Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory
- Discuz! X5.0
- File inclusion
Not analysed yet 15 Jun 2026
CVE-2016-20082 CVE record

CVSS 6.9 Medium

WordPress Plugin Abtest Local File Inclusion via abtest_admin.php
- Abtest
- File inclusion
Not analysed yet 15 Jun 2026
CVE-2016-20080 CVE record

CVSS 6.9 Medium

WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php
- Brandfolder
- File inclusion
Not analysed yet 15 Jun 2026
CVE-2016-20079 CVE record

CVSS 6.9 Medium

WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php
- jamie Dharma Booking
- File inclusion
Not analysed yet 15 Jun 2026
CVE-2016-20078 CVE record

CVSS 6.9 Medium

WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php
- Henrique Dias IMDb Profile Widget
- File inclusion
Not analysed yet 15 Jun 2026
CVE-2016-20077 CVE record

CVSS 6.9 Medium

WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php
- KaymeePhotography Photocart Link
- File inclusion
Not analysed yet 15 Jun 2026
CVE-2016-20064 CVE record

CVSS 6.9 Medium

WP Vault 0.8.6.6 Local File Inclusion via wpv-image Parameter
- myasui WP Vault
- File inclusion
Not analysed yet 9 Jun 2026
CVE-2026-9662 CVE record

CVSS 8.1 High

Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter
- plasmatizemedia Recover Exit For WooCommerce
- File inclusion
Not analysed yet 9 Jun 2026
CVE-2025-68886 CVE record

CVSS 8.1 High

WordPress Cookiteer theme <= 1.4.8 - Local File Inclusion vulnerability
- androThemes Cookiteer
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2025-69369 CVE record

CVSS 8.1 High

WordPress Racquet theme <= 1.12.0 - Local File Inclusion vulnerability
- Axiomthemes Racquet
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2025-58897 CVE record

CVSS 8.1 High

WordPress Fermentio theme <= 1.5.0 - Local File Inclusion vulnerability
- Axiomthemes Fermentio
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2025-58707 CVE record

CVSS 8.1 High

WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability
- Axiomthemes Spin
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2026-39553 CVE record

CVSS 8.1 High

WordPress WaveRide theme <= 1.4 - Local File Inclusion vulnerability
- Select-Themes WaveRide
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2026-39552 CVE record

CVSS 8.1 High

WordPress Blueprint theme < 1.1.5 - Local File Inclusion vulnerability
- Code Supply Co. Blueprint
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2025-58705 CVE record

CVSS 8.1 High

WordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability
- Axiomthemes Crafti
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2025-58024 CVE record

CVSS 7.5 High

WordPress Accordion FAQ Plugin <= 2.2.1 - Local File Inclusion Vulnerability
- UnboundStudio Accordion FAQ
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2025-53440 CVE record

CVSS 8.1 High

WordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability
- Axiomthemes Confidant
- File inclusion
Not analysed yet 2 Jun 2026
CVE-2026-44239 CVE record

CVSS 7.6 High

FreePBX: Authenticated Local File Inclusion in Dashboard Module
- FreePBX security-reporting
- File inclusion
Not analysed yet 29 May 2026
CVE-2026-37266 CVE record

CVSS 8.0 High

An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_download.php component
- File inclusion
Not analysed yet 28 May 2026
CVE-2026-48972 CVE record

CVSS 7.5 High

WordPress SeedProd Pro plugin < 6.19.5 - Local File Inclusion vulnerability
- SeedProd LLC SeedProd Pro
- File inclusion
Not analysed yet 27 May 2026
CVE-2026-9200 CVE record

CVSS 7.5 High

Query Shortcode <= 0.2.1 - Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute
- shazdeh Query Shortcode
- File inclusion
Not analysed yet 27 May 2026
getkirby/cms Packagist

CVSS 8.8 High

Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
- Path traversal
- File inclusion
>=5.3.0, <5.4.1 · fixed in 5.4.1

GHSA-9hx7-c53c-v6x8 · CVE-2026-44177 Not analysed yet 26 May 2026
CVE-2026-48133 CVE record

CVSS 7.5 High

Identity Awareness Captive Portal - Unauthenticated Local File Inclusion
- checkpoint Quantum Security Gateway
- File inclusion
Not analysed yet 26 May 2026
CVE-2026-39661 CVE record

CVSS 7.5 High

WordPress SW Core plugin <= 1.7.18 - Local File Inclusion vulnerability
- Magentech SW Core
- File inclusion
Not analysed yet 26 May 2026
concrete5/concrete5 Packagist

CVSS 9.4 CriticalCritical · CVSS 9+

Concrete CMS Vulnerable to Relative Path Traversal
- Path traversal
- File inclusion
<9.5.1 · fixed in 9.5.1

GHSA-645j-cm4x-3xvw · CVE-2026-8134 Not analysed yet 21 May 2026
CVE-2026-7522 CVE record

CVSS 8.8 High

Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'
- SigmaPlugin Advanced Database Cleaner – Premium
- File inclusion
Not analysed yet 20 May 2026
CVE-2018-25329 CVE record

CVSS 8.7 High

WordPress Plugin WP with Spritz 1.0 Remote File Inclusion
- wp-with-spritz WP with Spritz
- File inclusion
Not analysed yet 17 May 2026
CVE-2018-25324 CVE record

CVSS 6.9 Medium

Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath
- Simple-Fields Simple Fields
- File inclusion
Not analysed yet 17 May 2026
CVE-2021-47978 CVE record

CVSS 6.9 Medium

ProcessMaker 3.5.4 Local File Inclusion via Path Traversal
- ProcessMaker
- File inclusion
Not analysed yet 16 May 2026
CVE-2020-37246 CVE record

CVSS 6.9 Medium

WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion
- Supsystic Backup
- File inclusion
Not analysed yet 16 May 2026
CVE-2020-37169 CVE record

CVSS 6.8 Medium

WordPress Plugin ultimate-member 2.1.3 Local File Inclusion
- Ultimate Member ultimate-member
- File inclusion
Not analysed yet 13 May 2026
CVE-2026-3425 CVE record

CVSS 8.8 High

RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
- rometheme RTMKit
- File inclusion
Not analysed yet 13 May 2026
yiisoft/yii2 Packagist

CVSS 7.4 High

Yii 2: Local file inclusion via view parameter name collision
- File inclusion
- CWE-20
<2.0.55 · fixed in 2.0.55

GHSA-5vpg-rj7q-qpw2 · CVE-2026-39850 Not analysed yet 11 May 2026
CVE-2022-50954 CVE record

CVSS 6.9 Medium

WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion
- cab-fare-calculator
- File inclusion
Not analysed yet 10 May 2026