CVE-2025-69035

CVE-2025-69035 describes a deserialization of untrusted data vulnerability in the WordPress plugin Dental Care CPT (by strongholdthemes) affecting versions up to 20.2. The issue enables PHP Object Injection via deserialization of untrusted data, with the attack surface limited to the plugin’s den...

CVE-2025-68899 WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Vivagh vivagh allows Object Injection.This issue affects Vivagh: from n/a through = 2.4...

CVE-2025-68899

CVE-2025-68899 (Vivagh theme, WordPress) Deserialization of untrusted data in designthemes Vivagh, affected up to version 2.4, enables Object Injection. Public sources (NVD/Red Hat/CVE list) confirm the flaw and affected scope but do not provide a confirmed fix or patched version. Related entries...

CVE-2025-68510

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeGoods Photography photography allows PHP Local File Inclusion.This issue affects Photography: from n/a through 7.7.5...

CVE-2025-68047 WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through = 4.1.3...

CVE-2025-68047

CVE-2025-68047 affects the WordPress plugin Eventin (WP Event Manager) with versions up to and including 4.1.1. The issue is a deserialization of untrusted data leading to PHP object injection, reported as an authenticated vulnerability (Contributor+ access). Public references in Wordfence Intell...

CVE-2025-67957 WordPress Listivo Core plugin <= 2.3.77 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in TangibleWP Listivo Core listivo-core allows PHP Local File Inclusion.This issue affects Listivo Core: from n/a through = 2.3.77...

CVE-2025-67946

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in scriptsbundle AdForest adforest allows PHP Local File Inclusion.This issue affects AdForest: from n/a through = 6.0.11...

CVE-2025-67940

CVE-2025-67940 — Mikado-Themes Powerlift Local File Inclusion (LFI) Description in sources confirms an improper control of filenames for include/require in the PHP code, enabling PHP Local File Inclusion via PHP Remote File Inclusion vectors. The vulnerability affects Powerlift versions before 3....

CVE-2025-67940 WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through 3.2.1...

CVE-2025-67938

CVE-2025-67938 describes an unauthenticated Local File Inclusion in the WordPress theme Mikado-Themes Biagiotti, due to improper control of filenames for include/require in PHP (a PHP Remote File Inclusion condition). Affected software: Biagiotti versions before 3.5.2. Red Hat and CVE records cor...

CVE-2025-67616 WordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through = 1.2.29...

CVE-2025-67615

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through = 1.5.1...

CVE-2025-67615 WordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through = 1.5.1...

CVE-2025-67616

CVE-2025-67616 corresponds to a Local File Inclusion (LFI) vulnerability in the WordPress Mella theme (Mella

CVE-2025-63017

CVE-2025-63017 affects the WordPress WerkStatt Plugin (werkstatt-plugin) up to version 1.6.6, with an improper control of filename in include/require (Local File Inclusion). The Red Hat/NVD entries and PatchStack/Wordfence references corroborate this LFI issue for WerkStatt

CVE-2025-50004 WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through = 4.10.1...

CVE-2025-49994

CVE-2025-49994 affects the WordPress Athens theme (ovatheme Athens) prior to or equal to version 1.1.6, enabling unauthenticated Local File Inclusion via improper control of filename in Include/Require statements (PHP Remote File Inclusion). Publicly documented in NVD/Red Hat/ENISA and reflected ...

CVE-2025-47474

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ninetheme Anarkali anarkali allows PHP Local File Inclusion.This issue affects Anarkali: from n/a through = 1.0.9...

CVE-2025-47474

CVE-2025-47474 is an Unauthenticated Local File Inclusion flaw in the WordPress theme Anarkali (Ninetheme) up to version 1.0.9, caused by improper control of include/require filenames in PHP. The vulnerability affects Anarkali