Vulnerability database

1,939 results · page 17 of 39

• Feb 20, 2026Eleblog – Elementor Blog And Magazine Addons: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69374 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SolverWp Eleblog – Elementor Blog And Magazine Addons ele-blog allows PHP Local File Inclusion.This issue affects Eleblog – Elementor Blog And Magazine Addons: from n/a through <= 2.0.3.

  Product

  Eleblog – Elementor Blog And Magazine Addons

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update Eleblog – Elementor Blog And Magazine Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026VidoRev: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69373 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 VidoRev vidorev allows PHP Local File Inclusion.This issue affects VidoRev: from n/a through <= 2.9.9.9.9.9.7.

  Product

  VidoRev

  Affected

  up to 2.9.9.9.9.9.7

  What to do

  Affects up to 2.9.9.9.9.9.7. Update VidoRev to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026PeakShops: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-69322 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes PeakShops peakshops allows PHP Local File Inclusion.This issue affects PeakShops: from n/a through < 1.5.9.

  Product

  PeakShops

  What to do

  Update PeakShops to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026TopperPack – Complete Elementor Addons, Theme & CPT Builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68841 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder topper-pack allows PHP Local File Inclusion.This issue affects TopperPack – Complete Elementor Addons, Theme & CPT Builder: from n/a through <= 1.2.1.

  Product

  TopperPack – Complete Elementor Addons, Theme & CPT Builder

  Affected

  up to 1.2.1

  What to do

  Affects up to 1.2.1. Update TopperPack – Complete Elementor Addons, Theme & CPT Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026WooCommerce Coming Soon Product with Countdown: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68552 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace WooCommerce Coming Soon Product with Countdown woo-coming-soon-product allows PHP Local File Inclusion.This issue affects WooCommerce Coming Soon Product with Countdown: from n/a through <= 5.0.

  Product

  WooCommerce Coming Soon Product with Countdown

  Affected

  up to 5.0

  What to do

  Affects up to 5.0. Update WooCommerce Coming Soon Product with Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Nika: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68545 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.

  Product

  Nika

  Affected

  up to 1.2.14

  What to do

  Affects up to 1.2.14. Update Nika to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Diza: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68543 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.

  Product

  Diza

  Affected

  up to 1.3.15

  What to do

  Affects up to 1.3.15. Update Diza to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Fana: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68539 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35.

  Product

  Fana

  Affected

  up to 1.1.35

  What to do

  Affects up to 1.1.35. Update Fana to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Zota: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68536 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14.

  Product

  Zota

  Affected

  up to 1.3.14

  What to do

  Affects up to 1.3.14. Update Zota to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Paid Member Subscriptions: Authorization Bypass Through User-Controlled KeyCVE-2025-68514 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.16.8.

  Product

  Paid Member Subscriptions

  Affected

  up to 2.16.8

  What to do

  Affects up to 2.16.8. Update Paid Member Subscriptions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Shiprocket: Authorization Bypass Through User-Controlled KeyCVE-2025-68051 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through <= 2.0.8.

  Product

  Shiprocket

  Affected

  up to 2.0.8

  What to do

  Affects up to 2.0.8. Update Shiprocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026PatioTime: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67992 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean PatioTime patiotime allows PHP Local File Inclusion.This issue affects PatioTime: from n/a through < 2.1.

  Product

  PatioTime

  What to do

  Update PatioTime to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026CozyStay: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67988 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.9.1.

  Product

  CozyStay

  What to do

  Update CozyStay to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Urna: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67982 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna urna allows PHP Local File Inclusion.This issue affects Urna: from n/a through <= 2.5.12.

  Product

  Urna

  Affected

  up to 2.5.12

  What to do

  Affects up to 2.5.12. Update Urna to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Besa: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67981 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.15.

  Product

  Besa

  Affected

  up to 2.3.15

  What to do

  Affects up to 2.3.15. Update Besa to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Hara: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-67980 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.17.

  Product

  Hara

  Affected

  up to 1.2.17

  What to do

  Affects up to 1.2.17. Update Hara to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026WPForms Google Sheet Connector: Improper Control of Generation of Code ('Code Injection')CVE-2025-67979 · WordPress plugins & themes · reported by PatchstackCritical 9.9

  Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1.

  Product

  WPForms Google Sheet Connector

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update WPForms Google Sheet Connector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Extensive VC Addons for WPBakery page builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60087 · WordPress plugins & themes · reported by PatchstackHigh 8.1

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nenad Obradovic Extensive VC Addons for WPBakery page builder extensive-vc-addon allows PHP Local File Inclusion.This issue affects Extensive VC Addons for WPBakery page builder: from n/a through <= 1.9.1.

  Product

  Extensive VC Addons for WPBakery page builder

  Affected

  up to 1.9.1

  What to do

  Affects up to 1.9.1. Update Extensive VC Addons for WPBakery page builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 20, 2026Inpersttion For: Improper Control of Generation of Code ('Code Injection')CVE-2025-52744 · WordPress plugins & themes · reported by PatchstackHigh 7.7

  Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through <= 1.0.

  Product

  Inpersttion For

  Affected

  up to 1.0

  What to do

  Affects up to 1.0. Update Inpersttion For to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Airtifact: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27343 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VanKarWai Airtifact airtifact allows PHP Local File Inclusion.This issue affects Airtifact: from n/a through <= 1.2.91.

  Product

  Airtifact

  Affected

  up to 1.2.91

  What to do

  Affects up to 1.2.91. Update Airtifact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Sales Countdown Timer for WooCommerce and: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-27052 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPress sctv-sales-countdown-timer allows PHP Local File Inclusion.This issue affects Sales Countdown Timer for WooCommerce and WordPress: from n/a through < 1.1.9.

  Product

  Sales Countdown Timer for WooCommerce and

  What to do

  Update Sales Countdown Timer for WooCommerce and to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026EventPrime: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25389 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.8.3.

  Product

  EventPrime

  Affected

  up to 4.2.8.3

  What to do

  Affects up to 4.2.8.3. Update EventPrime to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026CMSMasters Content Composer: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25326 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer cmsmasters-content-composer allows PHP Local File Inclusion.This issue affects CMSMasters Content Composer: from n/a through <= 1.4.5.

  Product

  CMSMasters Content Composer

  Affected

  up to 1.4.5

  What to do

  Affects up to 1.4.5. Update CMSMasters Content Composer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026rtMedia for WordPress, BuddyPress and bbPress: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25325 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through <= 4.7.8.

  Product

  rtMedia for WordPress, BuddyPress and bbPress

  Affected

  up to 4.7.8

  What to do

  Affects up to 4.7.8. Update rtMedia for WordPress, BuddyPress and bbPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Quiz And Survey Master: Authorization Bypass Through User-Controlled KeyCVE-2026-25324 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.4.

  Product

  Quiz And Survey Master

  Affected

  up to 10.3.4

  What to do

  Affects up to 10.3.4. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Frontend File Manager: Authorization Bypass Through User-Controlled KeyCVE-2026-25005 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frontend File Manager: from n/a through <= 23.5.

  Product

  Frontend File Manager

  Affected

  up to 23.5

  What to do

  Affects up to 23.5. Update Frontend File Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 19, 2026Breadcrumb NavXT: Authorization bypass through user-controlled keyCVE-2025-13842 · WordPress plugins & themes · reported by WordfenceMedium 5.3

  The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due to the Gutenberg block renderer trusting the $_REQUEST['post_id'] parameter without verification in the includes/blocks/build/breadcrumb-trail/render.php file. This makes it possible for unauthenticated attackers to enumerate and view breadcrumb trails for draft or private posts by manipulating the post_id parameter, revealing post titles and hierarchy that should remain hidden.

  Product

  Breadcrumb NavXT

  Affected

  up to 7.5.0

  What to do

  Affects up to 7.5.0. Update Breadcrumb NavXT to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 17, 2026Zarinpal Gateway for WooCommerce: Improper Access Control to Payment Status UpdateCVE-2026-2592 · WordPress plugins & themes · reported by WordfenceHigh 7.7

  The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount.

  Product

  Zarinpal Gateway for WooCommerce

  Affected

  up to 5.0.16

  What to do

  Affects up to 5.0.16. Update Zarinpal Gateway for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Feb 3, 2026Unicamp: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-25027 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp unicamp allows PHP Local File Inclusion.This issue affects Unicamp: from n/a through <= 2.7.1.

  Product

  Unicamp

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Unicamp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Run Contests, Raffles, and Giveaways with ContestsWP: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-25023 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Retrieve Embedded Sensitive Data.This issue affects Run Contests, Raffles, and Giveaways with ContestsWP: from n/a through <= 2.0.7.

  Product

  Run Contests, Raffles, and Giveaways with ContestsWP

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update Run Contests, Raffles, and Giveaways with ContestsWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Hustle: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24998 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popup allows Retrieve Embedded Sensitive Data.This issue affects Hustle: from n/a through <= 7.8.9.2.

  Product

  Hustle

  Affected

  up to 7.8.9.2

  What to do

  Affects up to 7.8.9.2. Update Hustle to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 3, 2026Extensions For CF7: Authorization Bypass Through User-Controlled KeyCVE-2026-24991 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.

  Product

  Extensions For CF7

  Affected

  up to 3.4.0

  What to do

  Affects up to 3.4.0. Update Extensions For CF7 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Feb 2, 2026Spirit Framework: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2024-54263 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Talemy Spirit Framework allows PHP Local File Inclusion.This issue affects Spirit Framework: from n/a through 1.2.13.

  Product

  Spirit Framework

  Affected

  up to 1.2.13

  What to do

  Affects up to 1.2.13. Update Spirit Framework to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026EduBlink Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24635 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DevsBlink EduBlink Core edublink-core allows PHP Local File Inclusion.This issue affects EduBlink Core: from n/a through <= 2.0.7.

  Product

  EduBlink Core

  Affected

  up to 2.0.7

  What to do

  Affects up to 2.0.7. Update EduBlink Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Ultimate Reviews: Authorization Bypass Through User-Controlled KeyCVE-2026-24634 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Reviews: from n/a through <= 3.2.16.

  Product

  Ultimate Reviews

  Affected

  up to 3.2.16

  What to do

  Affects up to 3.2.16. Update Ultimate Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Rosebud: Authorization Bypass Through User-Controlled KeyCVE-2026-24631 · WordPress plugins & themes · reported by PatchstackMedium 5.4

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Rosebud rosebud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rosebud: from n/a through <= 1.4.

  Product

  Rosebud

  Affected

  up to 1.4

  What to do

  Affects up to 1.4. Update Rosebud to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Laurent: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24609 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent laurent allows PHP Local File Inclusion.This issue affects Laurent: from n/a through <= 3.1.

  Product

  Laurent

  Affected

  up to 3.1

  What to do

  Affects up to 3.1. Update Laurent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Laurent Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24608 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Laurent Core laurent-core allows PHP Local File Inclusion.This issue affects Laurent Core: from n/a through <= 2.4.1.

  Product

  Laurent Core

  Affected

  up to 2.4.1

  What to do

  Affects up to 2.4.1. Update Laurent Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026NextMove Lite: Authorization Bypass Through User-Controlled KeyCVE-2026-24599 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Authorization Bypass Through User-Controlled Key vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.

  Product

  NextMove Lite

  Affected

  up to 2.23.0

  What to do

  Affects up to 2.23.0. Update NextMove Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026AWP Classifieds: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24593 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through <= 4.4.3.

  Product

  AWP Classifieds

  Affected

  up to 4.4.3

  What to do

  Affects up to 4.4.3. Update AWP Classifieds to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Fraud Prevention For Woocommerce: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24553 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Retrieve Embedded Sensitive Data.This issue affects Fraud Prevention For Woocommerce: from n/a through <= 2.3.2.

  Product

  Fraud Prevention For Woocommerce

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update Fraud Prevention For Woocommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Omnipress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24538 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.6.7.

  Product

  Omnipress

  Affected

  up to 1.6.7

  What to do

  Affects up to 1.6.7. Update Omnipress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Webpushr: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24536 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.

  Product

  Webpushr

  Affected

  up to 4.38.0

  What to do

  Affects up to 4.38.0. Update Webpushr to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026Prowess: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24531 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Prowess prowess allows PHP Local File Inclusion.This issue affects Prowess: from n/a through <= 2.3.

  Product

  Prowess

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update Prowess to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 23, 2026WP FullCalendar: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24523 · WordPress plugins & themes · reported by PatchstackMedium 5.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.

  Product

  WP FullCalendar

  Affected

  up to 1.6

  What to do

  Affects up to 1.6. Update WP FullCalendar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Kentha Elementor Widgets: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-24390 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Kentha Elementor Widgets kentha-elementor allows PHP Local File Inclusion.This issue affects Kentha Elementor Widgets: from n/a through < 3.1.

  Product

  Kentha Elementor Widgets

  What to do

  Update Kentha Elementor Widgets to the newest version.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026WP Job Portal: Authorization Bypass Through User-Controlled KeyCVE-2026-24379 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Authorization Bypass Through User-Controlled Key vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.3.

  Product

  WP Job Portal

  Affected

  up to 2.4.3

  What to do

  Affects up to 2.4.3. Update WP Job Portal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Nexter Blocks: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2026-24377 · WordPress plugins & themes · reported by PatchstackMedium 4.3

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through <= 4.6.3.

  Product

  Nexter Blocks

  Affected

  up to 4.6.3

  What to do

  Affects up to 4.6.3. Update Nexter Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Gyan Elements: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-23978 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Softwebmedia Gyan Elements gyan-elements allows PHP Local File Inclusion.This issue affects Gyan Elements: from n/a through <= 2.2.1.

  Product

  Gyan Elements

  Affected

  up to 2.2.1

  What to do

  Affects up to 2.2.1. Update Gyan Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jan 22, 2026Golo: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-23975 · WordPress plugins & themes · reported by PatchstackHigh 7.5

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo golo allows PHP Local File Inclusion.This issue affects Golo: from n/a through < 1.7.5.

  Product

  Golo

  What to do

  Update Golo to the newest version.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.