CVE-2026-96837 | High | 8.8 | 2026-09-30 | Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. |
CVE-2026-89294 | High | 7.5 | 2026-09-30 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale… |
CVE-2026-50547 | High | 7.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() met… |
CVE-2026-49850 | High | 7.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and… |
CVE-2026-39353 | Critical | 9.1 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted temp… |
CVE-2026-13456 | High | 7.5 | 2026-09-25 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all vers… |
CVE-2026-12227 | Critical | 9.8 | 2026-09-24 | The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-templ… |
CVE-2026-87902 | High | 8.1 | 2026-09-22 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme direct… |
CVE-2026-9231 | High | 7.5 | 2026-09-22 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu… |
CVE-2026-92969 | High | 8.1 | 2026-09-22 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4… |
CVE-2026-88994 | Medium | 6.6 | 2026-09-18 | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at ren… |
CVE-2026-27556 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator c… |
CVE-2026-27555 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie… |
CVE-2026-85200 | High | 7.5 | 2026-09-12 | The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_wind… |
CVE-2026-87927 | High | 8.2 | 2026-09-09 | MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to ex… |
CVE-2026-15667 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-15406 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-11613 | Critical | 9.8 | 2026-09-04 | The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' para… |
CVE-2026-78478 | High | 8.1 | 2026-08-25 | The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attack… |
CVE-2026-14280 | Medium | 6.6 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7… |
CVE-2026-32560 | High | 8.8 | 2026-08-24 | Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions. |
CVE-2026-66671 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions. |
CVE-2026-66670 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Måne <= 1.7 versions. |
CVE-2026-66587 | Critical | 9.8 | 2026-08-24 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-28152 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. |
CVE-2026-28151 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. |
CVE-2026-66586 | Medium | 6.6 | 2026-08-20 | Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-28150 | High | 8.1 | 2026-08-20 | Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. |
CVE-2025-15637 | High | 8.1 | 2026-08-20 | Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions. |
CVE-2026-75963 | High | 7.5 | 2026-08-20 | The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_templ… |
CVE-2026-73387 | High | 8.1 | 2026-08-19 | Unauthenticated Local File Inclusion in Resido <= 1.5 versions. |
CVE-2026-73400 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions. |
CVE-2026-32464 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions. |
CVE-2026-28570 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions. |
CVE-2026-66657 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. |
CVE-2026-66656 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. |
CVE-2026-66653 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. |
CVE-2026-66450 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions. |
CVE-2026-66710 | High | 8.1 | 2026-08-06 | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. |
CVE-2026-17605 | Medium | 6.6 | 2026-08-01 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2026-63302 | | | 2026-07-28 | Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can includ… |
CVE-2026-65481 | High | 7.5 | 2026-07-23 | Contributor Local File Inclusion in Vino <= 1.9 versions. |
CVE-2026-65477 | High | 7.5 | 2026-07-23 | Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions. |
CVE-2026-44177 | | | 2026-07-16 | Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resul… |
CVE-2026-46687 | | | 2026-07-16 | Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_co… |
CVE-2026-57805 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP L… |
CVE-2026-57804 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for… |
CVE-2026-57803 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP… |
CVE-2026-57802 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Loca… |
CVE-2026-57801 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows P… |
CVE-2026-57800 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows… |
CVE-2026-57799 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File… |
CVE-2026-57798 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes news… |
CVE-2026-57796 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local… |
CVE-2026-57795 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP… |
CVE-2026-57794 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework al… |
CVE-2026-57793 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Loc… |
CVE-2026-57792 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local… |
CVE-2026-57791 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local… |
CVE-2026-57790 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Loc… |
CVE-2026-57789 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local F… |
CVE-2026-57788 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Loc… |
CVE-2026-57743 | High | 8.1 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-e… |
CVE-2026-15540 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the co… |
CVE-2026-15338 | High | 7.5 | 2026-07-11 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type… |
CVE-2025-11977 | Medium | 6.6 | 2026-07-10 | The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File… |
CVE-2026-13080 | Medium | 6.6 | 2026-07-09 | The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up t… |
CVE-2026-12194 | | | 2026-07-04 | PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on t… |
CVE-2026-5137 | Medium | 4.3 | 2026-07-03 | The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insuffic… |
CVE-2026-57749 | High | 7.5 | 2026-07-02 | Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions. |
CVE-2026-57748 | High | 7.5 | 2026-07-02 | Contributor Local File Inclusion in Shopify <= 1.0.0 versions. |
CVE-2026-42382 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Audrey <= 1.5 versions. |
CVE-2026-27412 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. |
CVE-2025-69133 | High | 7.5 | 2026-07-02 | Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. |
CVE-2025-58902 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. |
CVE-2026-12923 | High | 7.5 | 2026-07-01 | The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validatio… |
CVE-2026-57647 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions. |
CVE-2025-68064 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. |
CVE-2025-68063 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. |
CVE-2026-54845 | High | 8.1 | 2026-06-25 | Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions. |
CVE-2019-25760 | Medium | 6.2 | 2026-06-19 | Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base… |
CVE-2026-7515 | Critical | 9.8 | 2026-06-19 | The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes… |
CVE-2026-48820 | | | 2026-06-17 | CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 thr… |
CVE-2026-54814 | High | 8.1 | 2026-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local… |
CVE-2026-39590 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions. |
CVE-2026-39559 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions. |
CVE-2026-39523 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions. |
CVE-2025-69175 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions. |
CVE-2025-69174 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Etude <= 1.6 versions. |
CVE-2025-69170 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions. |
CVE-2025-69166 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions. |
CVE-2025-69164 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Skyward <= 1.10 versions. |
CVE-2025-69158 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Granola <= 1.13 versions. |
CVE-2025-69157 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gamic <= 1.15 versions. |
CVE-2025-69144 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Preservation <= 1.10 versions. |
CVE-2025-69126 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions. |
CVE-2025-69123 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions. |
CVE-2025-69120 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions. |
CVE-2025-69115 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions. |
CVE-2025-69106 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions. |