Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,938 results · page 24 of 39
Dec 9, 2025ekommart: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67525 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opal_WP ekommart ekommart allows PHP Local File Inclusion.This issue affects ekommart: from n/a through < 4.3.1.
- Product
- ekommart
- What to do
- Update ekommart to the newest version.
Dec 9, 2025Jobmonster Elementor Addon: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67524 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster Elementor Addon jobmonster-addon allows PHP Local File Inclusion.This issue affects Jobmonster Elementor Addon: from n/a through <= 1.1.4.
- Product
- Jobmonster Elementor Addon
- Affected
- up to 1.1.4
- What to do
- Affects up to 1.1.4. Update Jobmonster Elementor Addon to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Exhibz: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67523 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in trippleS Exhibz exhibz allows PHP Local File Inclusion.This issue affects Exhibz: from n/a through <= 3.0.9.
- Product
- Exhibz
- Affected
- up to 3.0.9
- What to do
- Affects up to 3.0.9. Update Exhibz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Jobmonster: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67522 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NooTheme Jobmonster noo-jobmonster allows PHP Local File Inclusion.This issue affects Jobmonster: from n/a through <= 4.8.2.
- Product
- Jobmonster
- Affected
- up to 4.8.2
- What to do
- Affects up to 4.8.2. Update Jobmonster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Select Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67521 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Select Core select-core allows PHP Local File Inclusion.This issue affects Select Core: from n/a through < 2.6.
- Product
- Select Core
- What to do
- Update Select Core to the newest version.
Dec 9, 2025Wilmër: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67515 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through < 3.5.
- Product
- Wilmër
- Fixed in
- 3.5
- What to do
- Update Wilmër to 3.5 or newer.
Dec 9, 2025Portfolio and Projects: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-67470 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1.5.5.
- Product
- Portfolio and Projects
- Affected
- up to 1.5.5
- What to do
- Affects up to 1.5.5. Update Portfolio and Projects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025GiveWP: Improper Control of Generation of Code ('Code Injection')CVE-2025-66533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Control of Generation of Code ('Code Injection') vulnerability in Liquid Web / StellarWP GiveWP give allows Code Injection.This issue affects GiveWP: from n/a through 4.13.1.
- Product
- GiveWP
- Affected
- up to 4.13.1
- What to do
- Affects up to 4.13.1. Update GiveWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025The7 Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63076 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 Elements dt-the7-core allows PHP Local File Inclusion.This issue affects The7 Elements: from n/a through <= 2.7.11.
- Product
- The7 Elements
- Affected
- up to 2.7.11
- What to do
- Affects up to 2.7.11. Update The7 Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025The7: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63074 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through < 12.8.1.1.
- Product
- The7
- What to do
- Update The7 to the newest version.
Dec 9, 2025Download Manager: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63070 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.32.
- Product
- Download Manager
- Affected
- up to 3.3.32
- What to do
- Affects up to 3.3.32. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Media LIbrary Assistant: Authorization Bypass Through User-Controlled KeyCVE-2025-63065 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media LIbrary Assistant: from n/a through <= 3.29.
- Product
- Media LIbrary Assistant
- Affected
- up to 3.29
- What to do
- Affects up to 3.29. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025UDesign Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63062 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AndonDesign UDesign Core u-design-core allows PHP Local File Inclusion.This issue affects UDesign Core: from n/a through <= 4.14.0.
- Product
- UDesign Core
- Affected
- up to 4.14.0
- What to do
- Affects up to 4.14.0. Update UDesign Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Custom Field Template: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63058 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through <= 2.7.6.
- Product
- Custom Field Template
- Affected
- up to 2.7.6
- What to do
- Affects up to 2.7.6. Update Custom Field Template to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Ronneby Theme Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63036 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DFDevelopment Ronneby Theme Core ronneby-core allows PHP Local File Inclusion.This issue affects Ronneby Theme Core: from n/a through <= 1.5.68.
- Product
- Ronneby Theme Core
- Affected
- up to 1.5.68
- What to do
- Affects up to 1.5.68. Update Ronneby Theme Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Hotel Booking: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63013 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedded Sensitive Data.This issue affects WP Hotel Booking: from n/a through <= 2.2.7.
- Product
- WP Hotel Booking
- Affected
- up to 2.2.7
- What to do
- Affects up to 2.2.7. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025WP Google Analytics Events: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-63009 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data.This issue affects WP Google Analytics Events: from n/a through <= 2.8.2.
- Product
- WP Google Analytics Events
- Affected
- up to 2.8.2
- What to do
- Affects up to 2.8.2. Update WP Google Analytics Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025North - Required: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-63003 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North - Required Plugin north-plugin allows PHP Local File Inclusion.This issue affects North - Required Plugin: from n/a through <= 1.4.2.
- Product
- North - Required
- Affected
- up to 1.4.2
- What to do
- Affects up to 1.4.2. Update North - Required to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Image Cleanup: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62737 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensitive Data.This issue affects Image Cleanup: from n/a through <= 1.9.2.
- Product
- Image Cleanup
- Affected
- up to 1.9.2
- What to do
- Affects up to 1.9.2. Update Image Cleanup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025User Spam Remover: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-62735 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded Sensitive Data.This issue affects User Spam Remover: from n/a through <= 1.1.
- Product
- User Spam Remover
- Affected
- up to 1.1
- What to do
- Affects up to 1.1. Update User Spam Remover to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 9, 2025Geo Controller: Insertion of Sensitive Information Into Sent DataCVE-2025-62109 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.
- Product
- Geo Controller
- Affected
- up to 8.9.4
- What to do
- Affects up to 8.9.4. Update Geo Controller to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Easy Invoice: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-66115 · WordPress plugins & themes · reported by PatchstackMedium 6.6
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4.
- Product
- Easy Invoice
- Affected
- up to 2.1.4
- What to do
- Affects up to 2.1.4. Update Easy Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Seriously Simple Podcasting: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-66059 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Retrieve Embedded Sensitive Data.This issue affects Seriously Simple Podcasting: from n/a through <= 3.13.0.
- Product
- Seriously Simple Podcasting
- Affected
- up to 3.13.0
- What to do
- Affects up to 3.13.0. Update Seriously Simple Podcasting to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2025Uncanny Automator: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-66056 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Embedded Sensitive Data.This issue affects Uncanny Automator: from n/a through < 6.10.0.
- Product
- Uncanny Automator
- What to do
- Update Uncanny Automator to the newest version.
Nov 13, 2025WooCommerce Ultimate Points And Rewards: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-64267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultimate-points-and-rewards allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Ultimate Points And Rewards: from n/a through <= 2.10.2.
- Product
- WooCommerce Ultimate Points And Rewards
- Affected
- up to 2.10.2
- What to do
- Affects up to 2.10.2. Update WooCommerce Ultimate Points And Rewards to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Alloggio - Hotel Booking: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64287 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Alloggio - Hotel Booking: from n/a through <= 1.8.
- Product
- Alloggio - Hotel Booking
- Affected
- up to 1.8
- What to do
- Affects up to 1.8. Update Alloggio - Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Simple Payment: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62075 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.
- Product
- Simple Payment
- Affected
- up to 2.4.6
- What to do
- Affects up to 2.4.6. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Savory: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62067 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Savory savory.This issue affects Savory: from n/a through <= 2.5.
- Product
- Savory
- Affected
- up to 2.5
- What to do
- Affects up to 2.5. Update Savory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Revolution: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62066 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Revolution revolution.This issue affects Revolution: from n/a through < 2.5.8.
- Product
- Revolution
- What to do
- Update Revolution to the newest version.
Nov 6, 2025Academist: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62055 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist academist.This issue affects Academist: from n/a through < 1.3.
- Product
- Academist
- What to do
- Update Academist to the newest version.
Nov 6, 2025Houzez: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62053 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.
- Product
- Houzez
- What to do
- Update Houzez to the newest version.
Nov 6, 2025TheGem Theme Elements (for WPBakery): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62045 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.
- Product
- TheGem Theme Elements (for WPBakery)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem Theme Elements (for WPBakery) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025ITok: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62014 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme ITok itok.This issue affects ITok: from n/a through <= 1.1.42.
- Product
- ITok
- Affected
- up to 1.1.42
- What to do
- Affects up to 1.1.42. Update ITok to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Famita: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62010 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Famita famita allows PHP Local File Inclusion.This issue affects Famita: from n/a through <= 1.54.
- Product
- Famita
- Affected
- up to 1.54
- What to do
- Affects up to 1.54. Update Famita to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WPC Product Options for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60248 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPClever WPC Product Options for WooCommerce wpc-product-options allows PHP Local File Inclusion.This issue affects WPC Product Options for WooCommerce: from n/a through <= 3.1.3.
- Product
- WPC Product Options for WooCommerce
- Affected
- up to 3.1.3
- What to do
- Affects up to 3.1.3. Update WPC Product Options for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Premmerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60241 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through <= 1.3.19.
- Product
- Premmerce
- Affected
- up to 1.3.19
- What to do
- Affects up to 1.3.19. Update Premmerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025AnyComment: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60240 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alexander AnyComment anycomment allows PHP Local File Inclusion.This issue affects AnyComment: from n/a through <= 0.3.6.
- Product
- AnyComment
- Affected
- up to 0.3.6
- What to do
- Affects up to 0.3.6. Update AnyComment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025WooCommerce Store Toolkit: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60204 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach WooCommerce Store Toolkit woocommerce-store-toolkit allows PHP Local File Inclusion.This issue affects WooCommerce Store Toolkit: from n/a through <= 2.4.3.
- Product
- WooCommerce Store Toolkit
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update WooCommerce Store Toolkit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Store Exporter: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60203 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows PHP Local File Inclusion.This issue affects Store Exporter: from n/a through <= 2.7.6.
- Product
- Store Exporter
- Affected
- up to 2.7.6
- What to do
- Affects up to 2.7.6. Update Store Exporter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Favorites: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60202 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kyle Phillips Favorites favorites allows PHP Local File Inclusion.This issue affects Favorites: from n/a through <= 2.3.6.
- Product
- Favorites
- Affected
- up to 2.3.6
- What to do
- Affects up to 2.3.6. Update Favorites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025aguilatechnologies WP Customer Area customer-area: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60201 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in aguilatechnologies WP Customer Area customer-area allows PHP Local File Inclusion. This issue affects WP Customer Area: before 8.3.4.
- Product
- aguilatechnologies WP Customer Area customer-area
- Fixed in
- 8.3.4
- What to do
- Update aguilatechnologies WP Customer Area customer-area to 8.3.4 or newer.
Nov 6, 2025LearnPress Export Import: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60200 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows PHP Local File Inclusion.This issue affects LearnPress Export Import: from n/a through <= 4.1.2.
- Product
- LearnPress Export Import
- Affected
- up to 4.1.2
- What to do
- Affects up to 4.1.2. Update LearnPress Export Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025InHype - Blog & Magazine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60199 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx InHype - Blog & Magazine WordPress Theme inhype allows PHP Local File Inclusion.This issue affects InHype - Blog & Magazine WordPress Theme: from n/a through <= 1.5.2.
- Product
- InHype - Blog & Magazine
- Affected
- up to 1.5.2
- What to do
- Affects up to 1.5.2. Update InHype - Blog & Magazine to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Saxon - Viral Content Blog & Magazine Marketing: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60198 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Saxon - Viral Content Blog & Magazine Marketing WordPress Theme saxon allows PHP Local File Inclusion.This issue affects Saxon - Viral Content Blog & Magazine Marketing WordPress Theme: from n/a through <= 1.9.3.
- Product
- Saxon - Viral Content Blog & Magazine Marketing
- Affected
- up to 1.9.3
- What to do
- Affects up to 1.9.3. Update Saxon - Viral Content Blog & Magazine Marketing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Simple Contact Forms: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60197 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows PHP Local File Inclusion.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.
- Product
- Simple Contact Forms
- Affected
- up to 1.6.4
- What to do
- Affects up to 1.6.4. Update Simple Contact Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Clearblue® Ovulation Calculator: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60196 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Clearblue Clearblue® Ovulation Calculator clearblue-ovulation-calculator allows PHP Local File Inclusion.This issue affects Clearblue® Ovulation Calculator: from n/a through <= 1.2.4.
- Product
- Clearblue® Ovulation Calculator
- Affected
- up to 1.2.4
- What to do
- Affects up to 1.2.4. Update Clearblue® Ovulation Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Premmerce Product Search for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60194 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows PHP Local File Inclusion.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.
- Product
- Premmerce Product Search for WooCommerce
- Affected
- up to 2.2.4
- What to do
- Affects up to 2.2.4. Update Premmerce Product Search for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Premmerce User Roles: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60193 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows PHP Local File Inclusion.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.
- Product
- Premmerce User Roles
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Premmerce User Roles to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Premmerce Wholesale Pricing for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60192 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows PHP Local File Inclusion.This issue affects Premmerce Wholesale Pricing for WooCommerce: from n/a through <= 1.1.10.
- Product
- Premmerce Wholesale Pricing for WooCommerce
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Premmerce Wholesale Pricing for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 6, 2025Premmerce Wishlist for WooCommerce: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60191 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist allows PHP Local File Inclusion.This issue affects Premmerce Wishlist for WooCommerce: from n/a through <= 1.1.10.
- Product
- Premmerce Wishlist for WooCommerce
- Affected
- up to 1.1.10
- What to do
- Affects up to 1.1.10. Update Premmerce Wishlist for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.