Início / CVEs
Base de CVEs
Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.
CVE-2025-58902
Alta · 8.1
CWE-98 02/07/2026
WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
CVE-2026-12923
Alta · 7.5
CWE-98 01/07/2026
Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a form shortcode containing file fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke arbitrary zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in sensitive information disclosure and potential further compromise depending on the functions available in the environment.
CVE-2026-57647
Alta · 7.5
CWE-98 26/06/2026
WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.
CVE-2025-68064
Alta · 7.5
CWE-98 26/06/2026
WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
CVE-2025-68063
Alta · 7.5
CWE-98 26/06/2026
WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
CVE-2026-54845
Alta · 8.1
CWE-98 25/06/2026
WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
CVE-2019-25760
Média · 5.5
CWE-98 19/06/2026
Joomla! Component Easy Shop 1.2.3 Local File Inclusion
Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to com_easyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.
CVE-2026-7515
Crítica · 9.8
CWE-98 19/06/2026
Vulnerabilidade de Inclusão Local de Arquivo no Plugin BetterDocs Pro para WordPress (CVE-2026-7515)
O plugin BetterDocs Pro para WordPress é vulnerável a Inclusão Local de Arquivo nas versões até, e incluindo, a 3.8.0, por meio do parâmetro doc_style. Isso torna possível que atacantes não autenticados incluam e executem arquivos .php arbitrários no servidor, permitindo a execução de qualquer código PHP presente nesses arquivos. Isso pode ser usado para contornar controles de acesso, obter dados sensíveis ou alcançar execução de código em casos nos quais tipos de arquivo .php possam ser enviados e incluídos.
CVE-2026-54814
Alta · 8.1
CWE-98 17/06/2026
WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion.
This issue affects Motors: from n/a through 1.4.109.
CVE-2026-39590
Alta · 8.1
CWE-98 17/06/2026
WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.
CVE-2026-39559
Alta · 8.1
CWE-98 17/06/2026
WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
CVE-2026-39523
Alta · 8.1
CWE-98 17/06/2026
WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.
CVE-2025-69175
Alta · 8.1
CWE-98 17/06/2026
WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
CVE-2025-69174
Alta · 8.1
CWE-98 17/06/2026
WordPress Etude theme <= 1.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Etude <= 1.6 versions.
CVE-2025-69170
Alta · 8.1
CWE-98 17/06/2026
WordPress Eventicity theme <= 1.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
CVE-2025-69166
Alta · 8.1
CWE-98 17/06/2026
WordPress Gunslinger theme <= 1.7 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.
CVE-2025-69164
Alta · 8.1
CWE-98 17/06/2026
WordPress Skyward theme <= 1.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
CVE-2025-69158
Alta · 8.1
CWE-98 17/06/2026
WordPress Granola theme <= 1.13 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
CVE-2025-69157
Alta · 8.1
CWE-98 17/06/2026
WordPress Gamic theme <= 1.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.
CVE-2025-69144
Alta · 8.1
CWE-98 17/06/2026
WordPress Preservation theme <= 1.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.
CVE-2025-69126
Alta · 8.1
CWE-98 17/06/2026
WordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
CVE-2025-69123
Alta · 8.1
CWE-98 17/06/2026
WordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
CVE-2025-69120
Alta · 8.1
CWE-98 17/06/2026
WordPress Dazzle theme <= 1.0.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
CVE-2025-69115
Alta · 8.1
CWE-98 17/06/2026
WordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme theme <= 1.2.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
CVE-2025-69106
Alta · 8.1
CWE-98 17/06/2026
WordPress Imba theme <= 1.5.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.