VulnSea

CWE-98

CVEs classified under CWE-98, newest first.

272 CVEsRSS

CVE-2026-15667High· 7.5PoC
1mo ago

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This mak…

▾ Midnightarraytics · Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerceEPSS 0.96%via NVD
CVE-2026-87927High· 8.2PoC
1mo ago

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequ…

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequ…

▾ MidnightMaxSite · MaxSite CMSEPSS 0.59%via NVD
CVE-2026-11613Critical· 9.8PoC
2mo ago

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to inclu…

▾ AbyssalEPSS 0.83%via NVD
CVE-2026-14280Medium· 6.6
2mo ago

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticat…

▾ SunlitEPSS 1.2%via NVD
CVE-2026-78478High· 8.1
2mo ago

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the executi…

▾ TwilightEPSS 0.79%via NVD
CVE-2026-32560High· 8.8
2mo ago

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions.

▾ TwilightEPSS 0.46%via NVD
CVE-2026-66671High· 8.1
2mo ago

Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.

▾ TwilightEPSS 0.47%via NVD
CVE-2026-66670High· 8.1
2mo ago

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

Unauthenticated Local File Inclusion in Måne <= 1.7 versions.

▾ TwilightEPSS 0.47%via NVD
CVE-2026-66587Critical· 9.8
2mo ago

Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions.

▾ MidnightEPSS 0.50%via NVD
CVE-2026-28152High· 8.1
2mo ago

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.

▾ TwilightEPSS 0.47%via NVD
CVE-2026-28151High· 8.1
2mo ago

Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

Unauthenticated Local File Inclusion in Tonda < 2.6 versions.

▾ TwilightEPSS 0.47%via NVD
CVE-2025-15637High· 8.1
2mo ago

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

▾ TwilightEPSS 0.47%via NVD
CVE-2026-17605Medium· 6.6
3mo ago

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.56 via the getpaid_payment_form_element function. This makes it possi…

▾ SunlitEPSS 1.2%via NVD
CVE-2026-15540Medium· 4.3
3mo ago

A vulnerability was detected in SourceCodester Online Book Store System 1.0

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument pa…

▾ SunlitEPSS 0.42%via NVD
CVE-2026-15338High· 7.5
3mo ago

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with c…

▾ TwilightEPSS 0.96%via NVD
CVE-2025-11977Medium· 6.6
3mo ago

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_ge…

The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.26.12 via the happyforms_ge…

▾ SunlitEPSS 0.87%via NVD
CVE-2026-12194None
4mo ago

PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system

PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.

▾ SunlitEPSS 0.38%via NVD
CVE-2026-5137Medium· 4.3
4mo ago

The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX …

The RTMKit (rometheme-for-elementor) plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.7 This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX …

▾ SunlitEPSS 0.45%via NVD
CVE-2025-69133High· 7.5
4mo ago

Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.

Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.

▾ TwilightEPSS 0.43%via NVD
CVE-2025-58902High· 8.1
4mo ago

Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.

Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions.

▾ TwilightEPSS 0.47%via NVD
CVE-2026-9559Critical· 9.9
4mo ago

Mautic vulnerable to Path Traversal via Campaign Import

Mautic vulnerable to Path Traversal via Campaign Import

▾ Midnightmautic · mautic/coreEPSS 0.58%via GHSA
CVE-2025-68064High· 7.5
4mo ago

Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

▾ TwilightEPSS 0.43%via NVD
CVE-2025-68063High· 7.5
4mo ago

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

▾ TwilightEPSS 0.43%via NVD
CVE-2019-25760Medium· 6.2PoC
4mo ago

Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths

Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the o…

▾ Twilightjoomtech · easy_shopEPSS 0.45%via NVD
CVE-2025-69148High· 8.1
4mo ago

Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

▾ TwilightEPSS 0.43%via NVD
CVE-2025-69175High· 8.1
4mo ago

Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

▾ TwilightEPSS 0.35%via NVD
CVE-2025-69174High· 8.1
4mo ago

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

▾ TwilightEPSS 0.35%via NVD
CVE-2025-69170High· 8.1
4mo ago

Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

▾ TwilightEPSS 0.35%via NVD
CVE-2025-69166High· 8.1
4mo ago

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

▾ TwilightEPSS 0.43%via NVD
CVE-2025-69164High· 8.1
4mo ago

Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

▾ TwilightEPSS 0.35%via NVD
CWE-98 vulnerabilities (CVEs) — page 3 · VulnSea