CVE-2025-67684

CVE-2025-67684 : Quick.Cart is vulnerable to Local File Inclusion and Path Traversal in the theme selection mechanism. A privileged user can upload arbitrary file contents and, since only the filename extension is validated, include and execute uploaded PHP code, causing Remote Code Execution on ...

CVE-2025-67684 Remote Code Execution via Local File Inclusion in Quick.Cart

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include and execute uploaded PHP code,...

WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Theme Listihub versions = 1.0.6...

PT-2026-4251

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through = 4.2.6...

WordPress plugin PawFriends – Pet Shop and Veterinary WordPress Theme: Cross-site Request Forgery Vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-4121

Name of the Vulnerable Software and Affected Versions XpeedStudio Bajaar - Highly Customizable WooCommerce WordPress Theme versions through 2.1.0 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusio...

PT-2026-3974

Name of the Vulnerable Software and Affected Versions ApusTheme Drone versions through 1.40 Description The software contains a flaw related to improper handling of user-supplied data during web page creation, which can lead to Reflected Cross-Site Scripting XSS. This allows an attacker to inject...

OpenSolution Quick.Cart path traversal vulnerability

OpenSolution Quick.Cart is an online store system developed by the Polish company OpenSolution. OpenSolution Quick.Cart has a path traversal vulnerability, which stems from issues with the theme selection mechanism involving local file inclusion and path traversal attacks. These vulnerabilities...

PT-2026-4129

Name of the Vulnerable Software and Affected Versions goalthemes Dekoro versions through 1.0.7 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local...

PT-2026-3929

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include and execute uploaded PHP code,...

PT-2026-4155

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Muji muji allows PHP Local File Inclusion.This issue affects Muji: from n/a through = 1.2.0...

WordPress plugin Houzez Theme – Functionality: Cross-site scripting vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-4153

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Indoor Plants indoor-plants allows PHP Local File Inclusion.This issue affects Indoor Plants: from n/a through = 1.2.7...

PT-2026-4127

Name of the Vulnerable Software and Affected Versions goalthemes Bailly versions through 1.3.4 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion of local fil...

PT-2026-4001

Name of the Vulnerable Software and Affected Versions ThemeGoods Grand Restaurant Theme Elements for Elementor versions through 2.1.1 Description The software contains a flaw related to improper input handling during web page generation, which can lead to Cross-site Scripting XSS. This allows for...

PT-2026-4156

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Tornados tornados allows PHP Local File Inclusion.This issue affects Tornados: from n/a through = 2.1...

PT-2026-4014

Name of the Vulnerable Software and Affected Versions Myour versions through 1.5.1 Description The software contains an Improper Control of Filename for Include/Require Statement issue, also known as a PHP Remote File Inclusion. This allows for PHP Local File Inclusion. Recommendations Update Myo...

PT-2026-4162

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Modern Housewife modernhousewife allows PHP Local File Inclusion.This issue affects Modern Housewife: from n/a through = 1.0.12...

PT-2026-4150

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Weedles weedles allows PHP Local File Inclusion.This issue affects Weedles: from n/a through = 1.1.12...

PT-2026-4260

Missing Authorization vulnerability in Theme-one The Grid the-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Grid: from n/a through 2.8.0...