Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,116 results · page 18 of 43
Jun 27, 2025Puca: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-30992 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local File Inclusion.This issue affects Puca: from n/a through <= 2.6.33.
- Product
- Puca
- Affected
- up to 2.6.33
- What to do
- Affects up to 2.6.33. Update Puca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025SERPed.net: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28998 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in serpednet SERPed.net serped-net allows PHP Local File Inclusion.This issue affects SERPed.net: from n/a through <= 4.6.
- Product
- SERPed.net
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update SERPed.net to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025SNS Vicky: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28990 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme SNS Vicky snsvicky allows PHP Local File Inclusion.This issue affects SNS Vicky: from n/a through <= 3.7.
- Product
- SNS Vicky
- Affected
- up to 3.7
- What to do
- Affects up to 3.7. Update SNS Vicky to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025MBStore - Digital WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28947 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme MBStore - Digital WooCommerce WordPress Theme mbstore allows PHP Local File Inclusion.This issue affects MBStore - Digital WooCommerce WordPress Theme: from n/a through <= 2.3.
- Product
- MBStore - Digital WooCommerce
- Affected
- up to 2.3
- What to do
- Affects up to 2.3. Update MBStore - Digital WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025PrintXtore: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28946 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme PrintXtore bw-printxtore allows PHP Local File Inclusion.This issue affects PrintXtore: from n/a through < 1.7.8.
- Product
- PrintXtore
- What to do
- Update PrintXtore to the newest version.
Jun 27, 2025Zenny: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24769 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Zenny bw-zenny allows PHP Local File Inclusion.This issue affects Zenny: from n/a through <= 1.7.5.
- Product
- Zenny
- Affected
- up to 1.7.5
- What to do
- Affects up to 1.7.5. Update Zenny to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Sofass: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24760 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Sofass sofass allows PHP Local File Inclusion.This issue affects Sofass: from n/a through <= 1.3.4.
- Product
- Sofass
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Sofass to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 27, 2025Samex - Clean, Minimal Shop WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2023-25998 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.6.
- Product
- Samex - Clean, Minimal Shop WooCommerce
- Affected
- up to 2.6
- What to do
- Affects up to 2.6. Update Samex - Clean, Minimal Shop WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025Classified Listing: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52715 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classified-listing allows PHP Local File Inclusion.This issue affects Classified Listing: from n/a through <= 4.2.0.
- Product
- Classified Listing
- Affected
- up to 4.2.0
- What to do
- Affects up to 4.2.0. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 20, 2025HUSKY: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-52708 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-filter allows PHP Local File Inclusion.This issue affects HUSKY: from n/a through <= 1.3.7.
- Product
- HUSKY
- Affected
- up to 1.3.7
- What to do
- Affects up to 1.3.7. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025CozyStay: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49508 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.7.1.
- Product
- CozyStay
- What to do
- Update CozyStay to the newest version.
Jun 17, 2025Diza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49261 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.8.
- Product
- Diza
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Diza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Aora: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49260 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.9.
- Product
- Aora
- Affected
- up to 1.3.9
- What to do
- Affects up to 1.3.9. Update Aora to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Hara: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49259 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.10.
- Product
- Hara
- Affected
- up to 1.2.10
- What to do
- Affects up to 1.2.10. Update Hara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Maia: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49258 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Maia maia allows PHP Local File Inclusion.This issue affects Maia: from n/a through <= 1.1.15.
- Product
- Maia
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update Maia to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Zota: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49257 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.8.
- Product
- Zota
- Affected
- up to 1.3.8
- What to do
- Affects up to 1.3.8. Update Zota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Sapa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49256 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa sapa allows PHP Local File Inclusion.This issue affects Sapa: from n/a through <= 1.1.14.
- Product
- Sapa
- Affected
- up to 1.1.14
- What to do
- Affects up to 1.1.14. Update Sapa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Ruza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49255 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Ruza ruza allows PHP Local File Inclusion.This issue affects Ruza: from n/a through <= 1.0.7.
- Product
- Ruza
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Ruza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Nika: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49254 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.8.
- Product
- Nika
- Affected
- up to 1.2.8
- What to do
- Affects up to 1.2.8. Update Nika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Lasa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49253 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Lasa lasa allows PHP Local File Inclusion.This issue affects Lasa: from n/a through <= 1.1.
- Product
- Lasa
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update Lasa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Besa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49252 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.8.
- Product
- Besa
- Affected
- up to 2.3.8
- What to do
- Affects up to 2.3.8. Update Besa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Fana: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49251 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.28.
- Product
- Fana
- Affected
- up to 1.1.28
- What to do
- Affects up to 1.1.28. Update Fana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025School Management: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-47572 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla School Management allows PHP Local File Inclusion. This issue affects School Management: from n/a through 93.0.0.
- Product
- School Management
- Affected
- up to 93.0.0
- What to do
- Affects up to 93.0.0. Update School Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025WPGYM: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32549 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in mojoomla WPGYM allows PHP Local File Inclusion. This issue affects WPGYM: from n/a through 65.0.
- Product
- WPGYM
- Affected
- up to 65.0
- What to do
- Affects up to 65.0. Update WPGYM to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Simen: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-29002 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Simen snssimen allows PHP Local File Inclusion.This issue affects Simen: from n/a through <= 4.6.
- Product
- Simen
- Affected
- up to 4.6
- What to do
- Affects up to 4.6. Update Simen to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025Evon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28991 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Evon snsevon allows PHP Local File Inclusion.This issue affects Evon: from n/a through <= 3.4.
- Product
- Evon
- Affected
- up to 3.4
- What to do
- Affects up to 3.4. Update Evon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 17, 2025DSK: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24761 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK dsk allows PHP Local File Inclusion.This issue affects DSK: from n/a through < 2.4.
- Product
- DSK
- What to do
- Update DSK to the newest version.
Jun 10, 2025TinySalt: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49454 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt tinysalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a through < 3.10.0.
- Product
- TinySalt
- What to do
- Update TinySalt to the newest version.
Jun 9, 2025Magze: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49282 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magze magze allows PHP Local File Inclusion.This issue affects Magze: from n/a through <= 1.0.9.
- Product
- Magze
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Magze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Magways: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49281 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magways magways allows PHP Local File Inclusion.This issue affects Magways: from n/a through <= 1.2.1.
- Product
- Magways
- Affected
- up to 1.2.1
- What to do
- Affects up to 1.2.1. Update Magways to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Magty: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49280 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magty magty allows PHP Local File Inclusion.This issue affects Magty: from n/a through <= 1.0.6.
- Product
- Magty
- Affected
- up to 1.0.6
- What to do
- Affects up to 1.0.6. Update Magty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Blogvy: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49279 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogvy blogvy allows PHP Local File Inclusion.This issue affects Blogvy: from n/a through <= 1.0.7.
- Product
- Blogvy
- Affected
- up to 1.0.7
- What to do
- Affects up to 1.0.7. Update Blogvy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Blogty: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49278 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogty blogty allows PHP Local File Inclusion.This issue affects Blogty: from n/a through <= 1.0.11.
- Product
- Blogty
- Affected
- up to 1.0.11
- What to do
- Affects up to 1.0.11. Update Blogty to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Blogprise: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49277 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogprise blogprise allows PHP Local File Inclusion.This issue affects Blogprise: from n/a through <= 1.0.9.
- Product
- Blogprise
- Affected
- up to 1.0.9
- What to do
- Affects up to 1.0.9. Update Blogprise to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Blogmine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49276 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogmine blogmine allows PHP Local File Inclusion.This issue affects Blogmine: from n/a through <= 1.1.7.
- Product
- Blogmine
- Affected
- up to 1.1.7
- What to do
- Affects up to 1.1.7. Update Blogmine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Blogbyte: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49275 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogbyte blogbyte allows PHP Local File Inclusion.This issue affects Blogbyte: from n/a through <= 1.1.1.
- Product
- Blogbyte
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update Blogbyte to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Essential Real Estate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48126 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a through <= 5.2.9.
- Product
- Essential Real Estate
- Affected
- up to 5.2.9
- What to do
- Affects up to 5.2.9. Update Essential Real Estate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025WP Event Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-48125 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through <= 3.1.51.
- Product
- WP Event Manager
- Affected
- up to 3.1.51
- What to do
- Affects up to 3.1.51. Update WP Event Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Revo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-39476 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo revo allows PHP Local File Inclusion.This issue affects Revo: from n/a through <= 4.0.26.
- Product
- Revo
- Affected
- up to 4.0.26
- What to do
- Affects up to 4.0.26. Update Revo to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Krowd: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32595 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Krowd krowd allows PHP Local File Inclusion.This issue affects Krowd: from n/a through < 1.5.0.
- Product
- Krowd
- What to do
- Update Krowd to the newest version.
Jun 9, 2025SNS Anton: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28992 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme SNS Anton snsanton allows PHP Local File Inclusion.This issue affects SNS Anton: from n/a through <= 4.1.
- Product
- SNS Anton
- Affected
- up to 4.1
- What to do
- Affects up to 4.1. Update SNS Anton to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Valen - Sport, Fashion WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28945 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Valen - Sport, Fashion WooCommerce WordPress Theme valen allows PHP Local File Inclusion.This issue affects Valen - Sport, Fashion WooCommerce WordPress Theme: from n/a through <= 2.4.
- Product
- Valen - Sport, Fashion WooCommerce
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update Valen - Sport, Fashion WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Avaz: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28944 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Avaz snsavaz allows PHP Local File Inclusion.This issue affects Avaz: from n/a through <= 2.8.
- Product
- Avaz
- Affected
- up to 2.8
- What to do
- Affects up to 2.8. Update Avaz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025GiftXtore: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-28888 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme GiftXtore bw-giftxtore allows PHP Local File Inclusion.This issue affects GiftXtore: from n/a through < 1.7.7.
- Product
- GiftXtore
- What to do
- Update GiftXtore to the newest version.
Jun 9, 2025Petito: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-27362 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Petito bw-petito allows PHP Local File Inclusion.This issue affects Petito: from n/a through < 1.6.6.
- Product
- Petito
- What to do
- Update Petito to the newest version.
Jun 9, 2025Lab: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-26592 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lab lab allows PHP Local File Inclusion.This issue affects Lab: from n/a through <= 1.0.0.
- Product
- Lab
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Lab to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025CraftXtore: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24770 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme CraftXtore bw-craftxtore allows PHP Local File Inclusion.This issue affects CraftXtore: from n/a through <= 1.7.
- Product
- CraftXtore
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update CraftXtore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Nitan: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-24768 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Nitan snsnitan allows PHP Local File Inclusion.This issue affects Nitan: from n/a through <= 2.9.
- Product
- Nitan
- Affected
- up to 2.9
- What to do
- Affects up to 2.9. Update Nitan to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025Fitrush: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2023-26005 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Fitrush allows PHP Local File Inclusion. This issue affects Fitrush: from n/a through 1.3.4.
- Product
- Fitrush
- Affected
- up to 1.3.4
- What to do
- Affects up to 1.3.4. Update Fitrush to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 9, 2025BodyCenter - Gym, Fitness WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2023-25999 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme BodyCenter - Gym, Fitness WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects BodyCenter - Gym, Fitness WooCommerce WordPress Theme: from n/a through 2.4.
- Product
- BodyCenter - Gym, Fitness WooCommerce
- Affected
- up to 2.4
- What to do
- Affects up to 2.4. Update BodyCenter - Gym, Fitness WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.