CVE-2025-24761

CVE-2025-24761 documents a PHP Local File Inclusion (LFI) in the WordPress DSK theme (snstheme DSK) due to Improper Control of Filename for Include/Require, affecting versions n/a through 2.2. The CVSSv3.1 base score is 8.1 (HIGH) with network attack vector, high complexity, no privileges require...

CVE-2025-29002

CVE-2025-29002 refers to a Local File Inclusion vulnerability in the WordPress theme Simen (versions n/a through 4.6). The root cause is improper control of the filename used in PHP include/require statements, enabling PHP Local File Inclusion. Affected software: Simen theme up to 4.6. Reported C...

CVE-2025-28991

CVE-2025-28991 : WordPress Evon theme

CVE-2025-28991 WordPress Evon theme <= 3.4 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in snstheme Evon snsevon allows PHP Local File Inclusion.This issue affects Evon: from n/a through = 3.4...

CVE-2025-31919 WordPress Spare <= 1.7 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7...

CVE-2025-32549 WordPress WPGYM <= 65.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in mojoomla WPGYM allows PHP Local File Inclusion. This issue affects WPGYM: from n/a through 65.0...

CVE-2025-32549

CVE-2025-32549 concerns the WordPress plugin WPGYM (Wordpress Gym Management System) with an authenticated Local File Inclusion due to improper filename handling. Public sources in the Connected documents indicate the vulnerability is present in versions up to 65.0 and is listed as an authenticat...

CVE-2025-47572 WordPress School Management <= 93.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in mojoomla School Management allows PHP Local File Inclusion. This issue affects School Management: from n/a through 93.0.0...

CVE-2025-47572 WordPress School Management <= 93.0.0 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in mojoomla School Management allows PHP Local File Inclusion. This issue affects School Management: from n/a through 93.0.0...

CVE-2025-47572

CVE-2025-47572 refers to an unauthenticated/local file inclusion flaw in the WordPress School Management plugin for versions n/a through 93.0.0, caused by improper control of include/require filenames in PHP. Public sources (NVD, CVE listings, Red Hat advisory, Patchstack, Wordfence) describe the...

CVE-2025-49251 WordPress Fana <= 1.1.28 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Fana allows PHP Local File Inclusion. This issue affects Fana: from n/a through 1.1.28...

CVE-2025-49253 WordPress Lasa <= 1.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Lasa allows PHP Local File Inclusion. This issue affects Lasa: from n/a through 1.1...

CVE-2025-49252

CVE-2025-49252 describes an unauthenticated Local File Inclusion in the WordPress Besa theme/plugin (thembay Besa) via improper control of filenames for include/require statements. Affected: Besa up to version 2.3.8. Patch: fixed in 2.3.10. CVSS v3.1 base score 8.1 (HIGH) with network attack vect...

CVE-2025-49253 WordPress Lasa theme <= 1.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Lasa lasa allows PHP Local File Inclusion.This issue affects Lasa: from n/a through = 1.1...

CVE-2025-49252 WordPress Besa theme <= 2.3.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through = 2.3.8...

CVE-2025-49253

CVE-2025-49253 describes an Unauthenticated Local File Inclusion in the WordPress theme Lasa (thembay) versions

CVE-2025-49255 WordPress Ruza theme <= 1.0.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Ruza ruza allows PHP Local File Inclusion.This issue affects Ruza: from n/a through = 1.0.7...

CVE-2025-49256

CVE-2025-49256 concerns the WordPress theme Sapa (thembay Sapa) with unauthenticated Local File Inclusion via improper control of include/require filenames. Affected versions are Sapa

CVE-2025-49257

CVE-2025-49257 affects the WordPress theme thembay Zota (versions &lt;= 1.3.8). The vulnerability stems from improper control of the filename in Include/Require statements, enabling Local File Inclusion (LFI) via PHP. The issue is documented with high severity (CVSS v3.1 base score 8.1; impact on...

CVE-2025-49256 WordPress Sapa <= 1.1.14 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Sapa allows PHP Local File Inclusion. This issue affects Sapa: from n/a through 1.1.14...