Advisories · Weakness

File inclusion.

A local or remote file included and run by the application. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-15667 CVE record

CVSS 7.5 High

Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- File inclusion
Not analysed yet 9 Sept 2026
CVE-2026-15406 CVE record

CVSS 7.5 High

Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- File inclusion
Not analysed yet 9 Sept 2026
CVE-2026-11613 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
- Divi Engine Divi Ajax Filter
- File inclusion
Not analysed yet 4 Sept 2026
CVE-2026-78478 CVE record

CVSS 8.1 High

Måne <= 1.7 - Unauthenticated Local File Inclusion
- Elated-Themes Mane
- File inclusion
Not analysed yet 25 Aug 2026
CVE-2026-14280 CVE record

CVSS 6.6 Medium

Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- File inclusion
Not analysed yet 25 Aug 2026
CVE-2026-32560 CVE record

CVSS 8.8 High

WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
- LiquidThemes MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator
- File inclusion
Not analysed yet 24 Aug 2026
CVE-2026-66670 CVE record

CVSS 8.1 High

WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
- Elated-Themes Måne
- File inclusion
Not analysed yet 24 Aug 2026
CVE-2026-66587 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
- WPCafe WP Cafe Pro
- File inclusion
Not analysed yet 24 Aug 2026
CVE-2026-28152 CVE record

CVSS 8.1 High

WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
- Select-Themes Tonda Core
- File inclusion
Not analysed yet 24 Aug 2026
CVE-2026-28151 CVE record

CVSS 8.1 High

WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
- Select-Themes Tonda
- File inclusion
Not analysed yet 24 Aug 2026
CVE-2026-66671 CVE record

CVSS 8.1 High

WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
- Elated-Themes Verdure Core
- File inclusion
Not analysed yet 24 Aug 2026
CVE-2026-66586 CVE record

CVSS 6.6 Medium

WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
- Themewinter WP Cafe Pro
- File inclusion
Not analysed yet 20 Aug 2026
CVE-2026-28150 CVE record

CVSS 8.1 High

WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
- uxper Golo Framework
- File inclusion
Not analysed yet 20 Aug 2026
CVE-2025-15637 CVE record

CVSS 8.1 High

WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability
- Edge Themes Shuffle
- File inclusion
Not analysed yet 20 Aug 2026
CVE-2026-75963 CVE record

CVSS 7.5 High

Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
- liedekef Events Made Easy
- File inclusion
Not analysed yet 20 Aug 2026
CVE-2026-73387 CVE record

CVSS 8.1 High

WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability
- SmartDataSoft Resido
- File inclusion
Not analysed yet 19 Aug 2026
CVE-2026-73400 CVE record

CVSS 8.1 High

WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
- jetmonsters Restaurant Menu by MotoPress
- File inclusion
Not analysed yet 18 Aug 2026
CVE-2026-32464 CVE record

CVSS 8.1 High

WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
- Vladimir Prelovac Theme Test Drive
- File inclusion
Not analysed yet 18 Aug 2026
CVE-2026-28570 CVE record

CVSS 8.1 High

WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
- SpabRice Vavo Core
- File inclusion
Not analysed yet 18 Aug 2026
CVE-2026-66657 CVE record

CVSS 8.1 High

WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability
- Mikado-Themes Biagiotti Core
- File inclusion
Not analysed yet 13 Aug 2026
CVE-2026-66656 CVE record

CVSS 8.1 High

WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability
- Mikado-Themes Foton Core
- File inclusion
Not analysed yet 13 Aug 2026
CVE-2026-66653 CVE record

CVSS 8.1 High

WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability
- Edge-Themes Barista
- File inclusion
Not analysed yet 13 Aug 2026
CVE-2026-66450 CVE record

CVSS 8.1 High

WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability
- Dylan Kuhn Geo Mashup
- File inclusion
Not analysed yet 13 Aug 2026
CVE-2026-66710 CVE record

CVSS 8.1 High

WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability
- e2pdf
- File inclusion
Not analysed yet 6 Aug 2026
CVE-2026-17605 CVE record

CVSS 6.6 Medium

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
- stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid
- File inclusion
Not analysed yet 1 Aug 2026
CVE-2026-63302 CVE record

CVSS 5.1 Medium

Local File Inclusion in Quick.CMS
- OpenSolution Quick.CMS
- File inclusion
Not analysed yet 28 Jul 2026
CVE-2026-65481 CVE record

CVSS 7.5 High

WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability
- Elated-Themes Vino
- File inclusion
Not analysed yet 23 Jul 2026
CVE-2026-65477 CVE record

CVSS 7.5 High

WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability
- Select-Themes Tonda Core
- File inclusion
Not analysed yet 23 Jul 2026
CVE-2026-46687 CVE record

CVSS 7.7 High

Emlog Local File Inclusion (LFI)
- emlog
- Path traversal
- File inclusion
Not analysed yet 16 Jul 2026
CVE-2026-57805 CVE record

CVSS 7.5 High

WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability
- Select-Themes Tonda
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57804 CVE record

CVSS 7.5 High

WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability
- CodexThemes TheGem Theme Elements (for Elementor)
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57803 CVE record

CVSS 7.5 High

WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability
- Select-Themes Struktur Core
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57802 CVE record

CVSS 7.5 High

WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability
- Select-Themes Struktur
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57801 CVE record

CVSS 7.5 High

WordPress SetSail theme <= 2.1 - Local File Inclusion vulnerability
- Select-Themes SetSail
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57800 CVE record

CVSS 7.5 High

WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability
- Edge-Themes Overworld
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57799 CVE record

CVSS 7.5 High

WordPress Nuss theme <= 1.3.6 - Local File Inclusion vulnerability
- uxper Nuss
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57798 CVE record

CVSS 7.5 High

WordPress NewsPlus Shortcodes plugin <= 4.2.0 - Local File Inclusion vulnerability
- SaurabhSharma NewsPlus Shortcodes
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57796 CVE record

CVSS 7.5 High

WordPress Leedo theme <= 3.0.0 - Local File Inclusion vulnerability
- VLThemes Leedo
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57795 CVE record

CVSS 7.5 High

WordPress Kitchor theme <= 1.4.3 - Local File Inclusion vulnerability
- themelexus Kitchor
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57794 CVE record

CVSS 7.5 High

WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability
- uxper Golo Framework
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57793 CVE record

CVSS 7.5 High

WordPress Flow theme <= 1.8 - Local File Inclusion vulnerability
- Elated-Themes Flow
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57792 CVE record

CVSS 7.5 High

WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerability
- Mikado-Themes Dør
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57791 CVE record

CVSS 7.5 High

WordPress Brook theme <= 2.9.0 - Local File Inclusion vulnerability
- ThemeMove Brook
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57789 CVE record

CVSS 7.5 High

WordPress Aqua theme <= 5.1.2 - Local File Inclusion vulnerability
- jwsthemes Aqua
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57790 CVE record

CVSS 7.5 High

WordPress Billey theme <= 2.1.8 - Local File Inclusion vulnerability
- ThemeMove Billey
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57788 CVE record

CVSS 7.5 High

WordPress Aalto theme <= 1.8 - Local File Inclusion vulnerability
- Edge-Themes Aalto
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-57743 CVE record

CVSS 8.1 High

WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Local File Inclusion vulnerability
- stmcan RT-Theme 18 | Extensions
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-15540 CVE record

CVSS 5.3 Medium

SourceCodester Online Book Store System Administrative index.php php file inclusion
- SourceCodester Online Book Store System
- Path traversal
- File inclusion
Not analysed yet 13 Jul 2026
CVE-2026-15338 CVE record

CVSS 7.5 High

LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting
- choijun LA-Studio Element Kit for Elementor
- File inclusion
Not analysed yet 11 Jul 2026
CVE-2025-11977 CVE record

CVSS 6.6 Medium

HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion
- Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms
- File inclusion
Not analysed yet 10 Jul 2026
CVE-2026-13080 CVE record

CVSS 6.6 Medium

WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
- getwpfunnels WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
- File inclusion
Not analysed yet 9 Jul 2026
CVE-2026-12194 CVE record

CVSS 2.3 Low

PHPIPAM Authenticated LFI
- phpipam
- File inclusion
Not analysed yet 4 Jul 2026
CVE-2026-5137 CVE record

CVSS 4.3 Medium

RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
- rometheme RTMKit
- File inclusion
Not analysed yet 3 Jul 2026
mautic/core Packagist

CVSS 9.9 CriticalCritical · CVSS 9+

Mautic vulnerable to Path Traversal via Campaign Import
- Path traversal
- File inclusion
>=7.0.0, <7.1.2 · fixed in 7.1.2

GHSA-6r9h-4h75-7q4x · CVE-2026-9559 Not analysed yet 2 Jul 2026
CVE-2026-57749 CVE record

CVSS 7.5 High

WordPress SportsPress Pro plugin <= 2.7.29 - Local File Inclusion vulnerability
- ThemeBoy SportsPress Pro
- File inclusion
Not analysed yet 2 Jul 2026
CVE-2026-57748 CVE record

CVSS 7.5 High

WordPress Shopify plugin <= 1.0.0 - Local File Inclusion vulnerability
- Shopify
- File inclusion
Not analysed yet 2 Jul 2026
CVE-2026-42382 CVE record

CVSS 8.1 High

WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability
- Elated-Themes Audrey
- File inclusion
Not analysed yet 2 Jul 2026
CVE-2026-27412 CVE record

CVSS 8.1 High

WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability
- StylemixThemes Pearl - Corporate Business
- File inclusion
Not analysed yet 2 Jul 2026
CVE-2025-69133 CVE record

CVSS 7.5 High

WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability
- GoodLayers Tourmaster
- File inclusion
Not analysed yet 2 Jul 2026
CVE-2025-58902 CVE record

CVSS 8.1 High

WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability
- AncoraThemes Lighthouse
- File inclusion
Not analysed yet 2 Jul 2026