469 matches found
CVE-2025-47439
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Chill Download Monitor download-monitor allows PHP Local File Inclusion.This issue affects Download Monitor: from n/a through = 5.0.22...
CVE-2025-47649
Path Traversal: '.../...//' vulnerability in StackWC Open Close WooCommerce Store woc-open-close allows PHP Local File Inclusion.This issue affects Open Close WooCommerce Store: from n/a through = 4.9.9...
CVE-2025-47533
Cross-Site Request Forgery CSRF vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows PHP Local File Inclusion.This issue affects Graphina: from n/a through = 3.0.4...
CVE-2025-47510
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in fullworks Display Eventbrite Events widget-for-eventbrite-api allows PHP Local File Inclusion.This issue affects Display Eventbrite Events: from n/a through 6.3...
CVE-2025-47496
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PublishPress PublishPress Authors publishpress-authors allows PHP Local File Inclusion.This issue affects PublishPress Authors: from n/a through = 4.7.5...
CVE-2025-47636
CVE-2025-47636 describes a Path Traversal vulnerability in the WordPress plugin “List category posts” (component: list-category-posts) allowing PHP Local File Inclusion. Public documentation indicates the issue affects versions up to 0.91.0 (and possibly 0.90.x family as per PT-2025-20199), with ...
CVE-2025-47533
CVE-2025-47533 (Graphina WordPress plugin) is a CSRF-to-PHP Local File Inclusion vulnerability affecting Graphina versions up to 3.0.4. The issue stems from cross-site request forgery that enables an attacker to trigger actions in the context of an authenticated user, potentially leading to local...
CVE-2025-47510
CVE-2025-47510 is a WordPress Display Eventbrite Events vulnerability: an authenticated (Contributor+) Local File Inclusion due to improper filename control in include/require statements. Affected software: Display Eventbrite Events = 6.3. If upgrade is not possible, apply vendor-provided mitigat...
CVE-2025-47494
CVE-2025-47494 concerns the WordPress plugin EventON (EventON-lite) with an Authenticated Local File Inclusion vulnerability. The issue stems from improper control of filenames used in PHP include/require, enabling LFI for attackers who have authenticated access. Affected software versions are Ev...
CVE-2025-47439
CVE-2025-47439 affects the WordPress plugin Download Monitor (versions through 5.0.22). Risk stems from improper control of filenames used in Include/Require, enabling Local File Inclusion via PHP Remote File Inclusion. CVSS v3.1 base score 7.5 (HIGH); attack vector NETWORK, access complexity HIG...
PT-2025-20206 · Unknown · Ilmosys Open Close Woocommerce Store
Name of the Vulnerable Software and Affected Versions: ilmosys Open Close WooCommerce Store versions 4.9.5 and earlier Description: The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion. This can be exploited to steal database credentials. There have been no reported...
PT-2025-20121 · Unknown · Publishpress Authors
Name of the Vulnerable Software and Affected Versions: PublishPress Authors versions through 4.7.5 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...
PT-2025-20123 · Unknown · Nicdark Hotel Booking
Name of the Vulnerable Software and Affected Versions: nicdark Hotel Booking versions n/a through 3.6 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion...
PT-2025-20078 · WordPress · Wpadverts
Name of the Vulnerable Software and Affected Versions: WPAdverts versions through 2.2.2 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a ty...
CVE-2025-39470
Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through = 1.6.0...
CVE-2025-39399
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows PHP Local File Inclusion.This issue affects License For Envato: from n/a through = 1.0.0...
CVE-2025-39379
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Capturly Capturly capturly-optimize-your-website allows PHP Local File Inclusion.This issue affects Capturly: from n/a through = 2.0.1...
CVE-2025-39360
CVE-2025-39360 refers to a Local File Inclusion in the Grace Mag WordPress theme (versions 1.1.5 and earlier). The issue stems from improper control of filenames in PHP include/require logic, i.e., a PHP Remote File Inclusion that permits local file inclusion. Affected product: Grace Mag theme up...
CVE-2025-39379
CVE-2025-39379 is a PHP Local File Inclusion vulnerability in the WordPress Capturly plugin, affecting versions n/a through 2.0.1. The issue arises from improper control of filenames used in include/require statements, enabling LFI in Capturly. Reported details indicate this is a plugin-specific ...