Vulnerability database

1,500 results · page 12 of 30

• Jan 8, 2026Typify: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22712 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through <= 3.0.2.

  Product

  Typify

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update Typify to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Mitech: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22708 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4.

  Product

  Mitech

  Affected

  up to 2.3.4

  What to do

  Affects up to 2.3.4. Update Mitech to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Moody: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22707 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through <= 2.7.3.

  Product

  Moody

  Affected

  up to 2.7.3

  What to do

  Affects up to 2.7.3. Update Moody to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Atlas: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-22509 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMRW-studio Atlas atlas allows PHP Local File Inclusion.This issue affects Atlas: from n/a through <= 2.1.0.

  Product

  Atlas

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update Atlas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Navian: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14431 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4.

  Product

  Navian

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Navian to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Brook: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14430 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

  Product

  Brook

  Affected

  up to 2.9.0

  What to do

  Affects up to 2.9.0. Update Brook to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026AeroLand: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14429 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through <= 1.6.6.

  Product

  AeroLand

  Affected

  up to 1.6.6

  What to do

  Affects up to 1.6.6. Update AeroLand to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Oshine: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-14359 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion. This issue affects Oshine: from n/a before 7.3.0.

  Product

  Oshine

  Fixed in

  7.3.0

  What to do

  Update Oshine to 7.3.0 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026OchaHouse: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-12550 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows PHP Local File Inclusion.This issue affects OchaHouse: from n/a through <= 2.2.8.

  Product

  OchaHouse

  Affected

  up to 2.2.8

  What to do

  Affects up to 2.2.8. Update OchaHouse to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 8, 2026Rozy - Flower Shop: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-12549 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allows PHP Local File Inclusion.This issue affects Rozy - Flower Shop: from n/a through <= 1.2.25.

  Product

  Rozy - Flower Shop

  Affected

  up to 1.2.25

  What to do

  Affects up to 1.2.25. Update Rozy - Flower Shop to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026Hope: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69081 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.

  Product

  Hope

  Affected

  up to 3.0.0

  What to do

  Affects up to 3.0.0. Update Hope to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026Gecko: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69080 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.

  Product

  Gecko

  Affected

  up to 1.9.8

  What to do

  Affects up to 1.9.8. Update Gecko to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 7, 2026Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: Missing AuthorizationCVE-2025-13722 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.7. This is due to missing capability checks on the `fluentform_ai_create_form` AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary forms via the publicly exposed AI builder.

  Product

  Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

  Affected

  up to 6.1.7

  What to do

  Affects up to 6.1.7. Update Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 6, 2026WPCHURCH: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32304 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7.0.

  Product

  WPCHURCH

  Affected

  up to 2.7.0

  What to do

  Affects up to 2.7.0. Update WPCHURCH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026TheGem Theme Elements (for Elementor): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69356 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows PHP Local File Inclusion.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.11.0.

  Product

  TheGem Theme Elements (for Elementor)

  Affected

  up to 5.11.0

  What to do

  Affects up to 5.11.0. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Calafate: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69342 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Calafate calafate allows PHP Local File Inclusion.This issue affects Calafate: from n/a through <= 1.7.7.

  Product

  Calafate

  Affected

  up to 1.7.7

  What to do

  Affects up to 1.7.7. Update Calafate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Issabella: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69086 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Issabella issabella allows PHP Local File Inclusion.This issue affects Issabella: from n/a through <= 1.1.2.

  Product

  Issabella

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update Issabella to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Frappé: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69083 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Frappé frappe allows PHP Local File Inclusion.This issue affects Frappé: from n/a through <= 1.8.

  Product

  Frappé

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Frappé to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Unauthorized access and modification of dataCVE-2025-9637 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.

  Product

  Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

  Affected

  up to 10.3.1

  What to do

  Affects up to 10.3.1. Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Time-based SQL InjectionCVE-2025-9318 · WordPress plugins & themes · reported by WordfenceMedium 6.5

  The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in all versions up to, and including, 10.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  Product

  Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

  Affected

  up to 10.3.1

  What to do

  Affects up to 10.3.1. Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jan 6, 2026Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker: Unauthorized loss of dataCVE-2025-9294 · WordPress plugins & themes · reported by WordfenceMedium 4.3

  The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results.

  Product

  Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

  Affected

  up to 10.3.1

  What to do

  Affects up to 10.3.1. Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgresearch.cleantalk.org

• Jan 5, 2026FreeAgent: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69087 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent freeagent allows PHP Local File Inclusion.This issue affects FreeAgent: from n/a through <= 2.1.2.

  Product

  FreeAgent

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update FreeAgent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025MAS Videos: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-62753 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MadrasThemes MAS Videos masvideos allows PHP Local File Inclusion.This issue affects MAS Videos: from n/a through <= 1.3.4.

  Product

  MAS Videos

  Affected

  up to 1.3.4

  What to do

  Affects up to 1.3.4. Update MAS Videos to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Lekker: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69034 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP Local File Inclusion.This issue affects Lekker: from n/a through <= 1.8.

  Product

  Lekker

  Affected

  up to 1.8

  What to do

  Affects up to 1.8. Update Lekker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Medicalequipment: Missing AuthorizationCVE-2025-69009 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.

  Product

  Medicalequipment

  Affected

  up to 1.0.9

  What to do

  Affects up to 1.0.9. Update Medicalequipment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Responsive Posts Carousel Pro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68996 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.

  Product

  Responsive Posts Carousel Pro

  Affected

  up to 15.1

  What to do

  Affects up to 15.1. Update Responsive Posts Carousel Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Cinerama: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68987 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows PHP Local File Inclusion.This issue affects Cinerama: from n/a through <= 2.9.

  Product

  Cinerama

  Affected

  up to 2.9

  What to do

  Affects up to 2.9. Update Cinerama to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Aora: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68985 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local File Inclusion.This issue affects Aora: from n/a through <= 1.3.15.

  Product

  Aora

  Affected

  up to 1.3.15

  What to do

  Affects up to 1.3.15. Update Aora to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Puca: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68984 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local File Inclusion.This issue affects Puca: from n/a through <= 2.6.39.

  Product

  Puca

  Affected

  up to 2.6.39

  What to do

  Affects up to 2.6.39. Update Puca to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025Greenmart: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68983 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP Local File Inclusion.This issue affects Greenmart: from n/a through <= 4.2.11.

  Product

  Greenmart

  Affected

  up to 4.2.11

  What to do

  Affects up to 4.2.11. Update Greenmart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 30, 2025WordPress Social Login and Register: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68974 · WordPress plugins & themes · reported by PatchstackMedium 6.6

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.

  Product

  WordPress Social Login and Register

  Affected

  up to 7.7.0

  What to do

  Affects up to 7.7.0. Update WordPress Social Login and Register to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 29, 2025CookieHint WP: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68870 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows PHP Local File Inclusion.This issue affects CookieHint WP: from n/a through <= 1.0.0.

  Product

  CookieHint WP

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update CookieHint WP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 29, 2025CedCommerce Integration for Good Market: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68877 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce CedCommerce Integration for Good Market ced-good-market-integration allows PHP Local File Inclusion.This issue affects CedCommerce Integration for Good Market: from n/a through <= 1.0.6.

  Product

  CedCommerce Integration for Good Market

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update CedCommerce Integration for Good Market to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Poll, Survey & Quiz Maker Plugin by Opinion Stage: Missing AuthorizationCVE-2025-68594 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Missing Authorization vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.12.0.

  Product

  Poll, Survey & Quiz Maker Plugin by Opinion Stage

  Affected

  up to 19.12.0

  What to do

  Affects up to 19.12.0. Update Poll, Survey & Quiz Maker Plugin by Opinion Stage to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Watu Quiz: Missing AuthorizationCVE-2025-68587 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.

  Product

  Watu Quiz

  Affected

  up to 3.4.5

  What to do

  Affects up to 3.4.5. Update Watu Quiz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Subscribe to Unlock Lite: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68563 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Unlock Lite subscribe-to-unlock-lite allows PHP Local File Inclusion.This issue affects Subscribe to Unlock Lite: from n/a through <= 1.3.0.

  Product

  Subscribe to Unlock Lite

  Affected

  up to 1.3.0

  What to do

  Affects up to 1.3.0. Update Subscribe to Unlock Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Fana: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68540 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35.

  Product

  Fana

  Affected

  up to 1.1.35

  What to do

  Affects up to 1.1.35. Update Fana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Zota: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68537 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14.

  Product

  Zota

  Affected

  up to 1.3.14

  What to do

  Affects up to 1.3.14. Update Zota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Bookory: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68530 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Bookory bookory allows PHP Local File Inclusion.This issue affects Bookory: from n/a through <= 2.2.7.

  Product

  Bookory

  Affected

  up to 2.2.7

  What to do

  Affects up to 2.2.7. Update Bookory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 24, 2025Docket Cache: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68506 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through <= 24.07.03.

  Product

  Docket Cache

  Affected

  up to 24.07.03

  What to do

  Affects up to 24.07.03. Update Docket Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 23, 2025TheGem Theme Elements (for Elementor): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68560 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.

  Product

  TheGem Theme Elements (for Elementor)

  Affected

  up to 5.10.5.1

  What to do

  Affects up to 5.10.5.1. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 23, 2025Nika: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68546 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.

  Product

  Nika

  Affected

  up to 1.2.14

  What to do

  Affects up to 1.2.14. Update Nika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 23, 2025Diza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68544 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.

  Product

  Diza

  Affected

  up to 1.3.15

  What to do

  Affects up to 1.3.15. Update Diza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Inset: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-6326 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Inset inset allows PHP Local File Inclusion.This issue affects Inset: from n/a through <= 1.18.0.

  Product

  Inset

  Affected

  up to 1.18.0

  What to do

  Affects up to 1.18.0. Update Inset to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025ListingPro: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64377 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.

  Product

  ListingPro

  What to do

  Update ListingPro to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Traveler: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64373 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.

  Product

  Traveler

  What to do

  Update Traveler to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025PenNews: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64223 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign PenNews pennews allows PHP Local File Inclusion.This issue affects PenNews: from n/a through < 6.7.3.

  Product

  PenNews

  What to do

  Update PenNews to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Jannah: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64205 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.0.

  Product

  Jannah

  Affected

  up to 7.6.0

  What to do

  Affects up to 7.6.0. Update Jannah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025XStore: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-64193 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in 8theme XStore xstore allows PHP Local File Inclusion.This issue affects XStore: from n/a through < 9.6.1.

  Product

  XStore

  What to do

  Update XStore to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Dec 18, 2025Task Manager: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60078 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia – Montpellier Task Manager task-manager allows PHP Local File Inclusion.This issue affects Task Manager: from n/a through <= 3.0.2.

  Product

  Task Manager

  Affected

  up to 3.0.2

  What to do

  Affects up to 3.0.2. Update Task Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.