CVE-2026-62858 | Medium | 5.3 | 2026-10-14 | YOURLS is a self-hosted, customizable URL shortener written in PHP. Prior to 1.10.5, yourls_get_request() extracted the request path without sanitization, afte… |
CVE-2026-110284 | High | 7.5 | 2026-10-14 | The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10… |
CVE-2026-104909 | High | 8.1 | 2026-10-14 | The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' par… |
CVE-2026-103367 | High | 8.1 | 2026-10-14 | The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the '… |
CVE-2026-104995 | High | 8.1 | 2026-10-14 | The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed fro… |
CVE-2026-66566 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. |
CVE-2026-62115 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. |
CVE-2026-62099 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. |
CVE-2026-62096 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. |
CVE-2026-62094 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. |
CVE-2026-62092 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. |
CVE-2026-62075 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. |
CVE-2026-62074 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. |
CVE-2026-62070 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
CVE-2026-62069 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
CVE-2026-62068 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
CVE-2026-62067 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
CVE-2026-62066 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
CVE-2026-62065 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
CVE-2026-62032 | Critical | 9.8 | 2026-10-10 | Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions. |
CVE-2026-62020 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
CVE-2026-48194 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
CVE-2026-48193 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. |
CVE-2026-42777 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. |
CVE-2026-42724 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. |
CVE-2026-42704 | High | 8.1 | 2026-10-10 | Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. |
CVE-2026-104899 | High | 8.1 | 2026-10-10 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-94067 | High | 8.1 | 2026-10-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows… |
CVE-2026-94062 | High | 8.1 | 2026-10-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows… |
CVE-2026-75028 | High | 7.5 | 2026-10-03 | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and… |
CVE-2026-92174 | High | 7.5 | 2026-10-02 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter… |
CVE-2026-71426 | | | 2026-10-01 | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior, an authenticated u… |
CVE-2026-96837 | High | 8.8 | 2026-09-30 | Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions. |
CVE-2026-89294 | High | 7.5 | 2026-09-30 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale… |
CVE-2026-50547 | High | 7.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() met… |
CVE-2026-49850 | High | 7.5 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and… |
CVE-2026-39353 | Critical | 9.1 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted temp… |
CVE-2026-13456 | High | 7.5 | 2026-09-25 | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all vers… |
CVE-2026-12227 | Critical | 9.8 | 2026-09-24 | The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-templ… |
CVE-2026-87902 | High | 8.1 | 2026-09-22 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme direct… |
CVE-2026-9231 | High | 7.5 | 2026-09-22 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and inclu… |
CVE-2026-92969 | High | 8.1 | 2026-09-22 | The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4… |
CVE-2026-88994 | Medium | 6.6 | 2026-09-18 | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at ren… |
CVE-2026-27556 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using a valid operator c… |
CVE-2026-27555 | High | 8.8 | 2026-09-16 | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a valid user cookie… |
CVE-2026-85200 | High | 7.5 | 2026-09-12 | The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_wind… |
CVE-2026-87927 | High | 8.2 | 2026-09-09 | MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to ex… |
CVE-2026-15667 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-15406 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-11613 | Critical | 9.8 | 2026-09-04 | The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' para… |
CVE-2026-78478 | High | 8.1 | 2026-08-25 | The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attack… |
CVE-2026-14280 | Medium | 6.6 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7… |
CVE-2026-32560 | High | 8.8 | 2026-08-24 | Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions. |
CVE-2026-66671 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions. |
CVE-2026-66670 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Måne <= 1.7 versions. |
CVE-2026-66587 | Critical | 9.8 | 2026-08-24 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-28152 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. |
CVE-2026-28151 | High | 8.1 | 2026-08-24 | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. |
CVE-2026-66586 | Medium | 6.6 | 2026-08-20 | Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-28150 | High | 8.1 | 2026-08-20 | Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. |
CVE-2025-15637 | High | 8.1 | 2026-08-20 | Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions. |
CVE-2026-75963 | High | 7.5 | 2026-08-20 | The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_templ… |
CVE-2026-73387 | High | 8.1 | 2026-08-19 | Unauthenticated Local File Inclusion in Resido <= 1.5 versions. |
CVE-2026-73400 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions. |
CVE-2026-32464 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions. |
CVE-2026-28570 | High | 8.1 | 2026-08-18 | Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions. |
CVE-2026-66657 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. |
CVE-2026-66656 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. |
CVE-2026-66653 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. |
CVE-2026-66450 | High | 8.1 | 2026-08-13 | Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions. |
CVE-2026-66710 | High | 8.1 | 2026-08-06 | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. |
CVE-2026-17605 | Medium | 6.6 | 2026-08-01 | The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includ… |
CVE-2026-63302 | | | 2026-07-28 | Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can includ… |
CVE-2026-65481 | High | 7.5 | 2026-07-23 | Contributor Local File Inclusion in Vino <= 1.9 versions. |
CVE-2026-65477 | High | 7.5 | 2026-07-23 | Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions. |
CVE-2026-44177 | | | 2026-07-16 | Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resul… |
CVE-2026-46687 | | | 2026-07-16 | Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_co… |
CVE-2026-57805 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP L… |
CVE-2026-57804 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for… |
CVE-2026-57803 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP… |
CVE-2026-57802 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Loca… |
CVE-2026-57801 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows P… |
CVE-2026-57800 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows… |
CVE-2026-57799 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File… |
CVE-2026-57798 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes news… |
CVE-2026-57796 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local… |
CVE-2026-57795 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP… |
CVE-2026-57794 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework al… |
CVE-2026-57793 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Loc… |
CVE-2026-57792 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local… |
CVE-2026-57791 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local… |
CVE-2026-57790 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Loc… |
CVE-2026-57789 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local F… |
CVE-2026-57788 | High | 7.5 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Loc… |
CVE-2026-57743 | High | 8.1 | 2026-07-13 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan RT-Theme 18 | Extensions rt18-e… |
CVE-2026-15540 | Medium | 4.3 | 2026-07-13 | A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the co… |
CVE-2026-15338 | High | 7.5 | 2026-07-11 | The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type… |
CVE-2025-11977 | Medium | 6.6 | 2026-07-10 | The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File… |
CVE-2026-13080 | Medium | 6.6 | 2026-07-09 | The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up t… |
CVE-2026-12194 | | | 2026-07-04 | PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on t… |