19434 matches found
CVE-2025-28979
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3...
CVE-2025-24766
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in wproyal News Magazine X news-magazine-x allows PHP Local File Inclusion.This issue affects News Magazine X: from n/a through = 1.2.37...
CVE-2025-54701
CVE-2025-54701 concerns WordPress ThemeMove Unicamp (Theme Unicamp) versions up to and including 2.6.3, describing an improper control of the filename used in include/require statements that enables Local File Inclusion (LFI). The issue is categorized as a WordPress Unicamp theme vulnerability af...
CVE-2025-54700
CVE-2025-54700 is a Local File Inclusion vulnerability in ThemeMove Makeaholic (WordPress) versions up to 1.8.4 caused by improper control of filenames in include/require statements. The issue could allow an attacker to access local files via PHP code execution paths exposed by the theme. Public ...
CVE-2025-54689 WordPress Urna Theme <= 2.5.7 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Urna urna allows PHP Local File Inclusion.This issue affects Urna: from n/a through = 2.5.7...
CVE-2025-54689
CVE-2025-54689 affects the WordPress theme Urna (thembay Urna) up to version 2.5.7 and is caused by an improper control of the filename for include/require statements, i.e., a PHP Local File Inclusion vulnerability. Public sources (Patchstack, patch details) confirm an unauthenticated Local File ...
CVE-2025-3703
The CVE-2025-3703 entry documents a Local File Inclusion (LFI) flaw in the WordPress plugin CSS & JavaScript Toolbox, caused by improper handling of include/require filename handling in PHP. Affects the plugin’s WordPress installation (CSS & JavaScript Toolbox) with versions prior to 12.0.3. CVSS...
CVE-2025-24766
CVE-2025-24766 : WordPress News Magazine X (WP Royal Themes) has an LFI flaw in PHP due to improper control of filenames for include/require. Affected: News Magazine X
CVE-2025-25172
CVE-2025-25172 affects VidMov WordPress Theme (
CVE-2025-25172 WordPress VidMov <= 1.9.4 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in beeteam368 VidMov vidmov allows PHP Local File Inclusion.This issue affects VidMov: from n/a through = 1.9.4...
CVE-2025-25174
BeeTeam368 Extensions (WordPress) is affected by CVE-2025-25174: an improper control of the filename for Include/Require statements leads to Local File Inclusion in versions up to 1.9.4. The CVSS 3.1 vector indicates Network access, low attack complexity, and high impact to confidentiality, integ...
CVE-2025-28979
CVE-2025-28979 concerns the WordPress plugin WP Pipes (version <= 1.4.3). The flaw is an improper control of the filename for include/require statements, enabling Local File Inclusion (LFI). Multiple sources (NVD, Red Hat advisory, CVE lists, Patchstack) confirm WP Pipes
CVE-2025-30635 WordPress IDonatePro <= 2.1.9 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeAtelier IDonatePro idonate-pro allows PHP Local File Inclusion.This issue affects IDonatePro: from n/a through = 2.1.9...
CVE-2025-30635 WordPress IDonatePro <= 2.1.9 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeAtelier IDonatePro idonate-pro allows PHP Local File Inclusion.This issue affects IDonatePro: from n/a through = 2.1.9...
CVE-2025-30635
CVE-2025-30635 affects IDonatePro (WordPress plugin) <= 2.1.9 and is described as an improper control of the filename for include/require statements, enabling PHP Local File Inclusion. Public sources in the connected documents corroborate the vulnerability as a Local File Inclusion issue and n...
CVE-2025-32288
CVE-2025-32288 – RT-Theme 18 Extensions (WordPress) Affects WordPress plugin: RT-Theme 18 Extensions, versions through 2.4. Description: Improper control of filenames for Include/Require statements in PHP (PHP Remote File Inclusion) leading to Local File Inclusion (LFI). The root cause is imprope...
CVE-2025-48293 WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Dylan Kuhn Geo Mashup allows PHP Local File Inclusion. This issue affects Geo Mashup: from n/a through 1.13.16...
CVE-2025-48332
CVE-2025-48332 denotes an unauthenticated Local File Inclusion in WordPress Gutenberg Blocks (PublishPress Blocks) affecting versions up to 3.3.1. The issue arises from improper control of filenames used in include/require statements (PHP Remote File Inclusion). CVSS v3.1 base score 7.5 (HIGH) wi...
CVE-2025-52716
CVE-2025-52716 concerns the WordPress plugin WP REST Cache prior to or up to version 2025.1.0. The vulnerability is an improper control of filenames for include/require statements, enabling local file inclusion (LFI) via the PHP runtime. Affected products are WP REST Cache (WordPress plugin); no ...
CVE-2025-52732 WordPress Google Map Targeting Plugin <= 1.1.6 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in RealMag777 Google Map Targeting allows PHP Local File Inclusion. This issue affects Google Map Targeting: from n/a through 1.1.6...