CVE-2025-60203 WordPress Store Exporter plugin <= 2.7.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows PHP Local File Inclusion.This issue affects Store Exporter: from n/a through = 2.7.6...

CVE-2025-60202

CVE-2025-60202 relates to the WordPress Favorites plugin (

CVE-2025-60202 WordPress Favorites plugin <= 2.3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Kyle Phillips Favorites favorites allows PHP Local File Inclusion.This issue affects Favorites: from n/a through = 2.3.6...

CVE-2025-60197

CVE-2025-60197 refers to a Local File Inclusion in the WordPress plugin Simple Contact Forms (owner: owenr88) version &lt;= 1.6.4, caused by improper control of the filename in include/require statements. Affected product/component: WordPress plugin Simple Contact Forms; vulnerability type: PHP L...

CVE-2025-60073 WordPress Responsive Sidebar plugin <= 1.2.2 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Processby Responsive Sidebar responsive-sidebar allows PHP Local File Inclusion.This issue affects Responsive Sidebar: from n/a through = 1.2.2...

CVE-2025-58998 WordPress s2Member Plugin <= 250701 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Cristián Lávaque s2Member s2member allows Object Injection.This issue affects s2Member: from n/a through = 250701...

CVE-2025-58619 WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through = 1.3.65...

CVE-2025-58619 WordPress Falang multilanguage Plugin <= 1.3.65 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in sbouey Falang multilanguage falang allows Object Injection.This issue affects Falang multilanguage: from n/a through = 1.3.65...

CVE-2025-58619

CVE-2025-58619 concerns Falang multilanguage for WordPress (versions

CVE-2025-53586

CVE-2025-53586 describes a deserialization of untrusted data vulnerability in the WordPress WordPress theme Noi? NooTheme WeMusic (noo-wemusic) affecting versions from n/a through ≤ 1.9.1. The underlying issue is PHP object injection due to deserializing untrusted data in the WeMusic plugin/theme...

CVE-2025-49393

CVE-2025-49393 (WordPress Sign-up Sheets plugin) exhibits Deserialization of Untrusted Data leading to PHP Object Injection in Sign-up Sheets

CVE-2025-49386 WordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Scott Reilly Preserve Code Formatting preserve-code-formatting allows Object Injection.This issue affects Preserve Code Formatting: from n/a through = 4.0.1...

CVE-2025-49386

CVE-2025-49386 : A deserialization-based PHP Object Injection vulnerability affects the WordPress plugin Preserve Code Formatting up to version 4.0.1. The issue arises from deserializing untrusted data, enabling object injection. The CVE entries consistently describe this as a vulnerability in th...

CVE-2025-39468

CVE-2025-39468 refers to a Local File Inclusion vulnerability in the WordPress Modal Survey plugin (modal-survey) affecting versions up to 2.0.2.0.1. The issue arises from improper control of filenames used in include/require, enabling an attacker to read local files via crafted input. The connec...

CVE-2025-39466 WordPress Dør theme <= 2.4 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through = 2.4...

CVE-2025-39463

CVE-2025-39463 is a WordPress Dessau theme local-file-inclusion vulnerability. Connected sources confirm an improper control of filenames for include/require leading to PHP Local File Inclusion in Dessau, affecting versions earlier than 1.9. The issue is documented as an LFI vulnerability in the ...

CVE-2025-12497

The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'argsextratemplatepath' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the...

WordPress plugin Favorites 安全漏洞

PHP, etc. are products of PHP. PHP is a scripting language that executes on the server side. webSockets ws, etc. are products of WebSockets open source. ws is a Node.js WebSocket library. r infrastructure gh, etc. are R infrastructure open source gh is a GitHub API library. A security vulnerabili...

PT-2025-45262

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in PoloPag PoloPag - Pix Automático para Woocommerce wc-polo-payments allows PHP Local File Inclusion.This issue affects PoloPag - Pix Automático para Woocommerce: from n/a through ...

WordPress plugin PoloPag Pix Automático para Woocommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...