CVE Intelligence
Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

Severidade
Limpar

854 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2026-66671 Alta · 8.1 CWE-98 24/08/2026
WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
CVE-2026-66670 Alta · 8.1 CWE-98 24/08/2026
WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
CVE-2026-66587 Crítica · 9.8 CWE-98 24/08/2026
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
CVE-2026-28152 Alta · 8.1 CWE-98 24/08/2026
WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
CVE-2026-28151 Alta · 8.1 CWE-98 24/08/2026
WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-66586 Média · 6.6 CWE-98 20/08/2026
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
CVE-2026-28150 Alta · 8.1 CWE-98 20/08/2026
WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
CVE-2025-15637 Alta · 8.1 CWE-98 20/08/2026
WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2026-75963 Alta · 7.5 CWE-98 20/08/2026
Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.
CVE-2026-73387 Alta · 8.1 CWE-98 19/08/2026
WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
CVE-2026-73400 Alta · 8.1 CWE-98 18/08/2026
WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2026-32464 Alta · 8.1 CWE-98 18/08/2026
WordPress Theme Test Drive plugin <= 2.9.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.
CVE-2026-28570 Alta · 8.1 CWE-98 18/08/2026
WordPress Vavo Core plugin <= 2.3.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.
CVE-2026-66657 Alta · 8.1 CWE-98 13/08/2026
WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
CVE-2026-66656 Alta · 8.1 CWE-98 13/08/2026
WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
CVE-2026-66653 Alta · 8.1 CWE-98 13/08/2026
WordPress Barista theme <= 2.5.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
CVE-2026-66450 Alta · 8.1 CWE-98 13/08/2026
WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
CVE-2026-66710 Alta · 8.1 CWE-98 06/08/2026
WordPress e2pdf plugin <= 1.32.40 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
CVE-2026-17605 Média · 6.6 CWE-98 01/08/2026
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.56 - Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVE-2026-63302 Média · 5.1 CWE-98 28/07/2026
Local File Inclusion in Quick.CMS
Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Successful exploitation allows disclosure of the server's directory structure and absolute file paths (path disclosure). The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
CVE-2026-65481 Alta · 7.5 CWE-98 23/07/2026
WordPress Vino theme <= 1.9 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Vino <= 1.9 versions.
CVE-2026-65477 Alta · 7.5 CWE-98 23/07/2026
WordPress Tonda Core plugin <= 2.1.2 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
CVE-2026-57805 Alta · 7.5 CWE-98 13/07/2026
WordPress Tonda theme <= 2.5 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.
CVE-2026-57804 Alta · 7.5 CWE-98 13/07/2026
WordPress TheGem Theme Elements (for Elementor) plugin < 5.12.1.1 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.
CVE-2026-57803 Alta · 7.5 CWE-98 13/07/2026
WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7.