CVE-2025-53198

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through = 4.0.4...

CVE-2025-48171

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Cena Store cena allows PHP Local File Inclusion.This issue affects Cena Store: from n/a through = 2.11.26...

CVE-2025-48298

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Benjamin Denis SEOPress for MainWP seopress-for-mainwp allows PHP Local File Inclusion.This issue affects SEOPress for MainWP: from n/a through = 1.4...

CVE-2025-48302

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Roxnor FundEngine wp-fundraising-donation allows PHP Local File Inclusion.This issue affects FundEngine: from n/a through = 1.7.4...

CVE-2025-48157

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through = 1.5.9...

CVE-2025-48160

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in CocoBasic Caliris caliris-wp allows PHP Local File Inclusion.This issue affects Caliris: from n/a through = 1.5...

CVE-2025-48149

CVE-2025-48149 affects the WordPress Cook&Meal theme (versions

CVE-2025-48157

CVE-2025-48157 affects WordPress plugin Formality (versions

CVE-2025-48171

CVE-2025-48171 is a WordPress Cena Store vulnerability (versions

CVE-2025-48298

CVE-2025-48298 is an unauthenticated Local File Inclusion in WordPress SEOPress for MainWP

CVE-2025-48302

Summary: CVE-2025-48302 is a Local File Inclusion in the WordPress FundEngine plugin (versions up to 1.7.4) caused by improper control of filenames in include/require statements (PHP.Remote File Inclusion pathway). Affected software: FundEngine – Donation and Crowdfunding Platform for WordPress (v

CVE-2025-53198

Houzez WordPress theme

CVE-2025-53204

CVE-2025-53204 is a Local File Inclusion vulnerability in the WordPress plugin Event List (ovatheme eventlist) affecting versions up to 1.9.2, caused by improper filename control for include/require statements. The vulnerability enables LFI and has a high impact (CVSS 3.1: 8.1). The issue is list...

CVE-2025-53210

The CVE-2025-53210 entry concerns bdthemes ZoloBlocks

CVE-2025-53210 WordPress ZoloBlocks Plugin <= 2.3.2 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in bdthemes ZoloBlocks zoloblocks allows PHP Local File Inclusion.This issue affects ZoloBlocks: from n/a through = 2.3.2...

CVE-2025-53565

CVE-2025-53565 concerns the WordPress plugin Widget for Google Reviews (RadiusTheme) and is triggered by an improper control of filename for include/require statements, i.e., a PHP Remote File Inclusion that allows PHP Local File Inclusion. Affected software: RadiusTheme Widget for Google Reviews...

CVE-2025-53567

CVE-2025-53567 describes an unauthenticated Local File Inclusion in WordPress Ghost Kit (PHP) due to improper filename handling in Include/Require statements, affecting Ghost Kit versions up to 3.4.1. Reported CVSS v3.1 base score 8.1 (HIGH) with NETWORK attack vector, HIGH impact on confidential...

CVE-2025-53567 WordPress Ghost Kit <= 3.4.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in nK Ghost Kit ghostkit allows PHP Local File Inclusion.This issue affects Ghost Kit: from n/a through = 3.4.1...

CVE-2025-53567 WordPress Ghost Kit <= 3.4.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in nK Ghost Kit allows PHP Local File Inclusion. This issue affects Ghost Kit: from n/a through 3.4.1...

CVE-2025-54017

CVE-2025-54017 is a PHP Local File Inclusion in the WordPress plugin Paid Member Subscriptions (vulnerable up to 2.15.4). The root cause is improper control of include/require filenames, enabling local file inclusion. The vulnerability is rated high (CVSS 3.1 base 7.5) with network access, high i...