CVE-2025-69038

CVE-2025-69038 describes an Unauthenticated Local File Inclusion in the WordPress theme Hyori (GoalThemes Hyori) via an improper control of filenames used in include/require statements. Affected: Hyori WordPress theme

CVE-2025-69037

CVE-2025-69037 is a WordPress Pippo theme Local File Inclusion vulnerability (PHP include/require filename control) affecting Pippo up to version 1.2.3. The issue enables including local files via PHP, with CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1, HIGH). Red Hat and CVE rec...

CVE-2025-69037

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This issue affects Pippo: from n/a through = 1.2.3...

CVE-2025-68047

CVE-2025-68047 affects the WordPress plugin Eventin (WP Event Manager) with versions up to and including 4.1.1. The issue is a deserialization of untrusted data leading to PHP object injection, reported as an authenticated vulnerability (Contributor+ access). Public references in Wordfence Intell...

CVE-2025-67940 WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through 3.2.1...

CVE-2025-67938

CVE-2025-67938 describes an unauthenticated Local File Inclusion in the WordPress theme Mikado-Themes Biagiotti, due to improper control of filenames for include/require in PHP (a PHP Remote File Inclusion condition). Affected software: Biagiotti versions before 3.5.2. Red Hat and CVE records cor...

CVE-2025-67616 WordPress Mella theme <= 1.2.29 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through = 1.2.29...

CVE-2025-67615

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through = 1.5.1...

CVE-2025-67616

CVE-2025-67616 corresponds to a Local File Inclusion (LFI) vulnerability in the WordPress Mella theme (Mella

CVE-2025-67615 WordPress Myour theme <= 1.5.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through = 1.5.1...

CVE-2025-49994

CVE-2025-49994 affects the WordPress Athens theme (ovatheme Athens) prior to or equal to version 1.1.6, enabling unauthenticated Local File Inclusion via improper control of filename in Include/Require statements (PHP Remote File Inclusion). Publicly documented in NVD/Red Hat/ENISA and reflected ...

CVE-2025-47474

CVE-2025-47474 is an Unauthenticated Local File Inclusion flaw in the WordPress theme Anarkali (Ninetheme) up to version 1.0.9, caused by improper control of include/require filenames in PHP. The vulnerability affects Anarkali

PT-2026-4122

Name of the Vulnerable Software and Affected Versions Elated-Themes Search & Go versions through 2.8 Description A flaw exists in the handling of file inclusion within Elated-Themes Search & Go, potentially allowing for PHP Local File Inclusion. This issue relates to improper control of filenames...

PT-2026-4147

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes DiveIt diveit allows PHP Local File Inclusion.This issue affects DiveIt: from n/a through = 1.4.3...

WordPress plugin Kentha Elementor Widgets has a security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There wa...

PT-2026-4015

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through = 1.2.29...

Azure Linux 3.0 Security Update: php (CVE-2022-31627)

The version of php installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-31627 advisory. - In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfobuffer, due to incorrect patch applied...

WordPress plugin Athens security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-4192

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3...

Amazon Linux 2 : php, --advisory ALAS2PHP8.1-2026-008 (ALASPHP8.1-2026-008)

The version of php installed on the remote host is prior to 8.1.34-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2PHP8.1-2026-008 advisory. NOTE: https://github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7NOTE:...