CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

864 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-42382 High · 8.1 CWE-98 Jul 2, 2026
WordPress Audrey theme <= 1.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Audrey <= 1.5 versions.
CVE-2026-27412 High · 8.1 CWE-98 Jul 2, 2026
WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
CVE-2025-69133 High · 7.5 CWE-98 Jul 2, 2026
WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability
Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
CVE-2025-58902 High · 8.1 CWE-98 Jul 2, 2026
WordPress Lighthouse theme <= 1.2.12 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.
CVE-2026-12923 High · 7.5 CWE-98 Jul 1, 2026
Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The user-supplied value is passed through sanitize_text_field(), has its trailing '_PLUGIN_DIR' substring stripped, and is then invoked as a PHP function name with no arguments via `$sess_name()`. The handler is gated only by a nonce — no current_user_can() check is present — and the nonce is emitted on any front-end page that renders a form shortcode containing file fields. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke arbitrary zero-argument PHP functions (such as phpinfo, phpversion, get_defined_vars, error_get_last), resulting in sensitive information disclosure and potential further compromise depending on the functions available in the environment.
CVE-2026-57647 High · 7.5 CWE-98 Jun 26, 2026
WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.6.1 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.
CVE-2025-68064 High · 7.5 CWE-98 Jun 26, 2026
WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
CVE-2025-68063 High · 7.5 CWE-98 Jun 26, 2026
WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
CVE-2026-54845 High · 8.1 CWE-98 Jun 25, 2026
WordPress MDTF plugin <= 1.3.8 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
CVE-2019-25760 Medium · 5.5 CWE-98 Jun 19, 2026
Joomla! Component Easy Shop 1.2.3 Local File Inclusion
Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to com_easyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.
CVE-2026-7515 Critical · 9.8 CWE-98 Jun 19, 2026
BetterDocs Pro WordPress Plugin Local File Inclusion Vulnerability (CVE-2026-7515)
The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVE-2026-54814 High · 8.1 CWE-98 Jun 17, 2026
WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.
CVE-2026-39590 High · 8.1 CWE-98 Jun 17, 2026
WordPress Atomlab theme <= 2.4.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Atomlab <= 2.4.5 versions.
CVE-2026-39559 High · 8.1 CWE-98 Jun 17, 2026
WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Uppercase < 1.2.2 versions.
CVE-2026-39523 High · 8.1 CWE-98 Jun 17, 2026
WordPress Solene Core plugin <= 2.3.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Solene Core <= 2.3.2 versions.
CVE-2025-69175 High · 8.1 CWE-98 Jun 17, 2026
WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
CVE-2025-69174 High · 8.1 CWE-98 Jun 17, 2026
WordPress Etude theme <= 1.6 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Etude <= 1.6 versions.
CVE-2025-69170 High · 8.1 CWE-98 Jun 17, 2026
WordPress Eventicity theme <= 1.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
CVE-2025-69166 High · 8.1 CWE-98 Jun 17, 2026
WordPress Gunslinger theme <= 1.7 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.
CVE-2025-69164 High · 8.1 CWE-98 Jun 17, 2026
WordPress Skyward theme <= 1.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
CVE-2025-69158 High · 8.1 CWE-98 Jun 17, 2026
WordPress Granola theme <= 1.13 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
CVE-2025-69157 High · 8.1 CWE-98 Jun 17, 2026
WordPress Gamic theme <= 1.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.
CVE-2025-69144 High · 8.1 CWE-98 Jun 17, 2026
WordPress Preservation theme <= 1.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.
CVE-2025-69126 High · 8.1 CWE-98 Jun 17, 2026
WordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
CVE-2025-69123 High · 8.1 CWE-98 Jun 17, 2026
WordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.