CVE-2025-69038

CVE-2025-69038 describes an Unauthenticated Local File Inclusion in the WordPress theme Hyori (GoalThemes Hyori) via an improper control of filenames used in include/require statements. Affected: Hyori WordPress theme

CVE-2025-69037

CVE-2025-69037 is a WordPress Pippo theme Local File Inclusion vulnerability (PHP include/require filename control) affecting Pippo up to version 1.2.3. The issue enables including local files via PHP, with CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1, HIGH). Red Hat and CVE rec...

CVE-2025-69037 WordPress Pippo theme <= 1.2.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This issue affects Pippo: from n/a through = 1.2.3...

CVE-2025-69040

CVE-2025-69040 affects WordPress theme/product: Bfres (goalthemes) with bfres, affected versions up to and including 1.2.1. Root cause is Improper Control of Filename for Include/Require in PHP, enabling Local File Inclusion (LFI). Red Hat and CVE/NVD entries describe Unauthenticated LFI, with im...

CVE-2025-69040 WordPress Bfres theme <= 1.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Bfres bfres allows PHP Local File Inclusion.This issue affects Bfres: from n/a through = 1.2.1...

CVE-2025-69037

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This issue affects Pippo: from n/a through = 1.2.3...

CVE-2025-69002 WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through = 3.9...

CVE-2025-69035

CVE-2025-69035 describes a deserialization of untrusted data vulnerability in the WordPress plugin Dental Care CPT (by strongholdthemes) affecting versions up to 20.2. The issue enables PHP Object Injection via deserialization of untrusted data, with the attack surface limited to the plugin’s den...

CVE-2025-69005 WordPress Search & Go theme <= 2.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Elated-Themes Search & Go search-and-go allows PHP Local File Inclusion.This issue affects Search & Go: from n/a through = 2.8...

CVE-2025-68899 WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through = 2.4...

CVE-2025-68899

CVE-2025-68899 (Vivagh theme, WordPress) Deserialization of untrusted data in designthemes Vivagh, affected up to version 2.4, enables Object Injection. Public sources (NVD/Red Hat/CVE list) confirm the flaw and affected scope but do not provide a confirmed fix or patched version. Related entries...

CVE-2025-68510

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through 7.7.5...

CVE-2025-68047

CVE-2025-68047 affects the WordPress plugin Eventin (WP Event Manager) with versions up to and including 4.1.1. The issue is a deserialization of untrusted data leading to PHP object injection, reported as an authenticated vulnerability (Contributor+ access). Public references in Wordfence Intell...

CVE-2025-68047 WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through = 4.1.3...

CVE-2025-67957 WordPress Listivo Core plugin <= 2.3.77 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Core: from n/a through = 2.3.77...

CVE-2025-67946

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through = 6.0.11...

CVE-2025-67940

CVE-2025-67940 — Mikado-Themes Powerlift Local File Inclusion (LFI) Description in sources confirms an improper control of filenames for include/require in the PHP code, enabling PHP Local File Inclusion via PHP Remote File Inclusion vectors. The vulnerability affects Powerlift versions before 3....

CVE-2025-67940 WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through 3.2.1...

CVE-2025-67938

CVE-2025-67938 describes an unauthenticated Local File Inclusion in the WordPress theme Mikado-Themes Biagiotti, due to improper control of filenames for include/require in PHP (a PHP Remote File Inclusion condition). Affected software: Biagiotti versions before 3.5.2. Red Hat and CVE records cor...

CVE-2025-67616 WordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through = 1.2.29...