Vulnerability database

11,285 results · page 58 of 226

• Dec 18, 2025ListingPro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64377 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.

  Product

  ListingPro

  What to do

  Update ListingPro to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025ListingPro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64376 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through < 2.9.10.

  Product

  ListingPro

  What to do

  Update ListingPro to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64373 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.

  Product

  Traveler

  What to do

  Update Traveler to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Traveler: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64372 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.

  Product

  Traveler

  What to do

  Update Traveler to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Traveler: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64371 · WordPress plugins & themes · reported by PatchstackHigh 8.5

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.

  Product

  Traveler

  What to do

  Update Traveler to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025ANAC XML Bandi di Gara: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64260 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marco Milesi ANAC XML Bandi di Gara avcp allows Reflected XSS.This issue affects ANAC XML Bandi di Gara: from n/a through <= 7.7.

  Product

  ANAC XML Bandi di Gara

  Affected

  up to 7.7

  What to do

  Affects up to 7.7. Update ANAC XML Bandi di Gara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Filr: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-64230 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Chill Filr filr-protection allows Path Traversal.This issue affects Filr: from n/a through <= 1.2.10.

  Product

  Filr

  Affected

  up to 1.2.10

  What to do

  Affects up to 1.2.10. Update Filr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8

  Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.

  Product

  Client Invoicing by Sprout Invoices

  Affected

  up to 20.8.7

  What to do

  Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Stockie Extra: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-64225 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Stockie Extra stockie-extra allows Code Injection.This issue affects Stockie Extra: from n/a through <= 1.2.11.

  Product

  Stockie Extra

  Affected

  up to 1.2.11

  What to do

  Affects up to 1.2.11. Update Stockie Extra to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025PenNews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64223 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign PenNews pennews allows PHP Local File Inclusion.This issue affects PenNews: from n/a through < 6.7.3.

  Product

  PenNews

  What to do

  Update PenNews to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64221 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.This issue affects Reservation Plugin: from n/a through <= 1.6.

  Product

  Reservation

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update Reservation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Photography: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64217 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Photography photography allows Reflected XSS.This issue affects Photography: from n/a through <= 7.7.2.

  Product

  Photography

  Affected

  up to 7.7.2

  What to do

  Affects up to 7.7.2. Update Photography to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025MasterStudy LMS Pro: Missing AuthorizationCVE-2025-64214 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.

  Product

  MasterStudy LMS Pro

  What to do

  Update MasterStudy LMS Pro to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025MasterStudy LMS Pro: Insertion of Sensitive Information Into Sent DataCVE-2025-64213 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.

  Product

  MasterStudy LMS Pro

  What to do

  Update MasterStudy LMS Pro to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Jannah: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64207 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows DOM-Based XSS.This issue affects Jannah: from n/a through <= 7.6.0.

  Product

  Jannah

  Affected

  up to 7.6.0

  What to do

  Affects up to 7.6.0. Update Jannah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Jannah: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64205 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.0.

  Product

  Jannah

  Affected

  up to 7.6.0

  What to do

  Affects up to 7.6.0. Update Jannah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64203 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster allows Reflected XSS.This issue affects Mailster: from n/a through < 4.1.14.

  Product

  Mailster

  What to do

  Update Mailster to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025XStore: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64193 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.

  Product

  XStore

  What to do

  Update XStore to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025XStore: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64191 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through < 9.6.1.

  Product

  XStore

  What to do

  Update XStore to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025XStore Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-64189 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through < 5.6.

  Product

  XStore Core

  What to do

  Update XStore Core to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025ListingPro: Missing AuthorizationCVE-2025-63039 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.9.

  Product

  ListingPro

  Affected

  up to 2.9.9

  What to do

  Affects up to 2.9.9. Update ListingPro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Support Board: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-60182 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through < 3.8.7.

  Product

  Support Board

  What to do

  Update Support Board to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Task Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60078 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia – Montpellier Task Manager task-manager allows PHP Local File Inclusion.This issue affects Task Manager: from n/a through <= 3.0.2.

  Product

  Task Manager

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update Task Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Ray Enterprise Translation: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60076 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.1.

  Product

  Ray Enterprise Translation

  Affected

  up to 1.7.1

  What to do

  Affects up to 1.7.1. Update Ray Enterprise Translation to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Anchor smooth scroll: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60072 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Anchor smooth scroll anchor-smooth-scroll allows PHP Local File Inclusion.This issue affects Anchor smooth scroll: from n/a through <= 1.0.2.

  Product

  Anchor smooth scroll

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update Anchor smooth scroll to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Riode: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60071 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through <= 1.6.23.

  Product

  Riode

  Affected

  up to 1.6.23

  What to do

  Affects up to 1.6.23. Update Riode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Molla: Improper Control of Generation of Code ('Code Injection')CVE-2025-60070 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Control of Generation of Code ('Code Injection') vulnerability in The4 Molla molla allows Code Injection.This issue affects Molla: from n/a through <= 1.5.13.

  Product

  Molla

  Affected

  up to 1.5.13

  What to do

  Affects up to 1.5.13. Update Molla to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025MinimogWP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60069 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

  Product

  MinimogWP

  Affected

  up to 3.9.6

  What to do

  Affects up to 3.9.6. Update MinimogWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Javo Core: Improper Control of Generation of Code ('Code Injection')CVE-2025-60068 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Control of Generation of Code ('Code Injection') vulnerability in javothemes Javo Core javo-core allows Code Injection.This issue affects Javo Core: from n/a through <= 3.0.0.266.

  Product

  Javo Core

  Affected

  up to 3.0.0.266

  What to do

  Affects up to 3.0.0.266. Update Javo Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Giardino: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60067 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Giardino giardino allows PHP Local File Inclusion.This issue affects Giardino: from n/a through <= 1.1.10.

  Product

  Giardino

  Affected

  up to 1.1.10

  What to do

  Affects up to 1.1.10. Update Giardino to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Katelyn: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60066 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Katelyn katelyn allows PHP Local File Inclusion.This issue affects Katelyn: from n/a through <= 1.0.10.

  Product

  Katelyn

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Katelyn to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Pinevale: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60065 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pinevale pinevale allows PHP Local File Inclusion.This issue affects Pinevale: from n/a through <= 1.0.14.

  Product

  Pinevale

  Affected

  up to 1.0.14

  What to do

  Affects up to 1.0.14. Update Pinevale to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Renewal: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60064 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Renewal renewal allows PHP Local File Inclusion.This issue affects Renewal: from n/a through <= 1.2.2.

  Product

  Renewal

  Affected

  up to 1.2.2

  What to do

  Affects up to 1.2.2. Update Renewal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Rosalinda: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60063 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Rosalinda rosalinda allows PHP Local File Inclusion.This issue affects Rosalinda: from n/a through <= 1.2.3.

  Product

  Rosalinda

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update Rosalinda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025tPlayer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60062 · WordPress plugins & themes · reported by PatchstackCritical 9.3

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist allows SQL Injection.This issue affects tPlayer: from n/a through <= 1.2.1.6.

  Product

  tPlayer

  Affected

  up to 1.2.1.6

  What to do

  Affects up to 1.2.1.6. Update tPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Kicker: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60061 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Kicker kicker allows PHP Local File Inclusion.This issue affects Kicker: from n/a through <= 2.2.0.

  Product

  Kicker

  Affected

  up to 2.2.0

  What to do

  Affects up to 2.2.0. Update Kicker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Pubzinne: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60060 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pubzinne pubzinne allows PHP Local File Inclusion.This issue affects Pubzinne: from n/a through <= 1.0.12.

  Product

  Pubzinne

  Affected

  up to 1.0.12

  What to do

  Affects up to 1.0.12. Update Pubzinne to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025smart SEO: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60059 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclusion.This issue affects smart SEO: from n/a through <= 2.12.

  Product

  smart SEO

  Affected

  up to 2.12

  What to do

  Affects up to 2.12. Update smart SEO to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025DetailX: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60058 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DetailX detailx allows PHP Local File Inclusion.This issue affects DetailX: from n/a through <= 1.10.0.

  Product

  DetailX

  Affected

  up to 1.10.0

  What to do

  Affects up to 1.10.0. Update DetailX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025DJ Rainflow: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60057 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DJ Rainflow dj-rainflow allows PHP Local File Inclusion.This issue affects DJ Rainflow: from n/a through <= 1.3.13.

  Product

  DJ Rainflow

  Affected

  up to 1.3.13

  What to do

  Affects up to 1.3.13. Update DJ Rainflow to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Winger: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60056 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Winger winger allows PHP Local File Inclusion.This issue affects Winger: from n/a through <= 1.0.16.

  Product

  Winger

  Affected

  up to 1.0.16

  What to do

  Affects up to 1.0.16. Update Winger to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Fabrica: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60055 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Fabrica fabrica allows PHP Local File Inclusion.This issue affects Fabrica: from n/a through <= 1.8.1.

  Product

  Fabrica

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update Fabrica to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025OnLeash: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60054 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes OnLeash onleash allows PHP Local File Inclusion.This issue affects OnLeash: from n/a through <= 1.5.2.

  Product

  OnLeash

  Affected

  up to 1.5.2

  What to do

  Affects up to 1.5.2. Update OnLeash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025MaxCube: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60053 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MaxCube maxcube allows PHP Local File Inclusion.This issue affects MaxCube: from n/a through <= 1.3.1.

  Product

  MaxCube

  Affected

  up to 1.3.1

  What to do

  Affects up to 1.3.1. Update MaxCube to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025W&D: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60052 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes W&D wd allows PHP Local File Inclusion.This issue affects W&D: from n/a through <= 1.0.

  Product

  W&D

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update W&D to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Rare Radio: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60051 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Rare Radio rareradio allows PHP Local File Inclusion.This issue affects Rare Radio: from n/a through <= 1.0.15.1.

  Product

  Rare Radio

  Affected

  up to 1.0.15.1

  What to do

  Affects up to 1.0.15.1. Update Rare Radio to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Panda: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60050 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Panda panda allows PHP Local File Inclusion.This issue affects Panda: from n/a through <= 1.21.

  Product

  Panda

  Affected

  up to 1.21

  What to do

  Affects up to 1.21. Update Panda to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Soleil: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60049 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleil soleil allows PHP Local File Inclusion.This issue affects Soleil: from n/a through <= 1.17.

  Product

  Soleil

  Affected

  up to 1.17

  What to do

  Affects up to 1.17. Update Soleil to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Tripster: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60048 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Tripster tripster allows PHP Local File Inclusion.This issue affects Tripster: from n/a through <= 1.0.10.

  Product

  Tripster

  Affected

  up to 1.0.10

  What to do

  Affects up to 1.0.10. Update Tripster to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025IPharm: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60047 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes IPharm ipharm allows PHP Local File Inclusion.This issue affects IPharm: from n/a through <= 1.2.3.

  Product

  IPharm

  Affected

  up to 1.2.3

  What to do

  Affects up to 1.2.3. Update IPharm to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.