Total
1299 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57793 | 2026-07-13 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8. | |||||
| CVE-2026-57743 | 2026-07-13 | N/A | 8.1 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows PHP Local File Inclusion.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5. | |||||
| CVE-2026-57791 | 2026-07-13 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0. | |||||
| CVE-2026-57799 | 2026-07-13 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6. | |||||
| CVE-2026-57805 | 2026-07-13 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5. | |||||
| CVE-2026-57800 | 2026-07-13 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5. | |||||
| CVE-2026-57796 | 2026-07-13 | N/A | 7.5 HIGH | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through <= 3.0.0. | |||||
| CVE-2025-11977 | 2026-07-10 | N/A | 6.6 MEDIUM | ||
| The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_get_form_partial() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. | |||||
| CVE-2026-13080 | 2026-07-09 | N/A | 6.6 MEDIUM | ||
| The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. | |||||
| CVE-2026-12194 | 2026-07-06 | N/A | N/A | ||
| PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations. | |||||
| CVE-2026-5137 | 2026-07-06 | N/A | 4.3 MEDIUM | ||
| The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute files on the server ending in _templates.php, allowing the execution of any PHP code in those files. | |||||
| CVE-2025-51057 | 1 Vedo Suite Project | 1 Vedo Suite | 2026-07-05 | N/A | 6.5 MEDIUM |
| A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'readfile()' function call in '/api_vedo/video/preview'. | |||||
| CVE-2026-27412 | 2026-07-02 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. | |||||
| CVE-2026-57748 | 2026-07-02 | N/A | 7.5 HIGH | ||
| Contributor Local File Inclusion in Shopify <= 1.0.0 versions. | |||||
| CVE-2025-69133 | 2026-07-02 | N/A | 7.5 HIGH | ||
| Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. | |||||
| CVE-2026-42382 | 2026-07-02 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. | |||||
| CVE-2025-58902 | 2026-07-02 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. | |||||
| CVE-2026-57749 | 2026-07-02 | N/A | 7.5 HIGH | ||
| Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions. | |||||
| CVE-2026-12923 | 2026-07-01 | N/A | 7.5 HIGH | ||
| The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a form shortcode containing file fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke arbitrary zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in sensitive information disclosure and potential further compromise depending on the functions available in the environment. | |||||
| CVE-2025-68063 | 2026-06-26 | N/A | 7.5 HIGH | ||
| Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. | |||||