CWE-98— PHP Remote File Inclusion
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.— MITRE CWE catalog
1,359 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-98page 20 of 28
- CVE-2021-47734HIGHCVSS 7.8EG 7.82025-12-23
CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary code. Attackers can leverage the vulnerability by changing the functions file path…
- CVE-2026-46687HIGHCVSS 7.7EG 7.72026-07-16
Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists…
- CVE-2026-24538HIGHCVSS 7.5EG 7.62026-01-23
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in omnipressteam Omnipress omnipress allows PHP Local File Inclusion.This issue affects Omnipress: from n/a through <= 1.…
- CVE-2025-63062HIGHCVSS 7.5EG 7.62025-12-09
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AndonDesign UDesign Core u-design-core allows PHP Local File Inclusion.This issue affects UDesign Core: from n/a throu…
- CVE-2025-64195HIGHCVSS 7.5EG 7.62025-10-29
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Eduma eduma allows PHP Local File Inclusion.This issue affects Eduma: from n/a through <= 5.7.6.
- CVE-2010-20125HIGHCVSS 7.5EG 7.52026-10-30
DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers…
- CVE-2017-20289HIGHCVSS 7.5EG 7.52026-10-22
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.…
- CVE-2026-110284HIGHCVSS 7.5EG 7.52026-10-14
The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode.…
- CVE-2026-75028HIGHCVSS 7.5EG 7.52026-10-03
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible f…
- CVE-2026-92174HIGHCVSS 7.5EG 7.52026-10-02
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.73.2 via the 'theme' parameter parameter. This makes it possible for authenticated attackers, with contributor…
- CVE-2026-89294HIGHCVSS 7.5EG 7.52026-09-30
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with …
- CVE-2026-49850HIGHCVSS 7.5EG 7.52026-09-25
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST …
- CVE-2026-50547HIGHCVSS 7.5EG 7.52026-09-25
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Invoices::generate_xml() method appends a database-derived xml_id to the XMLconfigs helper directory and inc…
- CVE-2026-13456HIGHCVSS 7.5EG 7.52026-09-25
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This make…
- CVE-2026-9231HIGHCVSS 7.5EG 7.52026-09-22
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for au…
- CVE-2026-85200HIGHCVSS 7.5EG 7.52026-09-12
The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_locator_ajax_info_window_loader function. This makes it possible for unauthenticated attackers to incl…
- CVE-2026-15667HIGHCVSS 7.5EG 7.52026-09-09
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This mak…
- CVE-2026-15406HIGHCVSS 7.5EG 7.52026-09-09
The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This mak…
- CVE-2026-75963HIGHCVSS 7.5EG 7.52026-08-20
The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contribut…
- CVE-2026-65481HIGHCVSS 7.5EG 7.52026-07-23
Contributor Local File Inclusion in Vino <= 1.9 versions.
- CVE-2026-65477HIGHCVSS 7.5EG 7.52026-07-23
Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions.
- CVE-2026-57805HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Tonda tonda allows PHP Local File Inclusion.This issue affects Tonda: from n/a through <= 2.5.
- CVE-2026-57804HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme El…
- CVE-2026-57803HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7.
- CVE-2026-57802HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7.
- CVE-2026-57801HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes SetSail setsail allows PHP Local File Inclusion.This issue affects SetSail: from n/a through <= 2.1.
- CVE-2026-57800HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.
- CVE-2026-57799HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.6.
- CVE-2026-57798HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SaurabhSharma NewsPlus Shortcodes newsplus-shortcodes allows PHP Local File Inclusion.This issue affects NewsPlus Shor…
- CVE-2026-57796HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in VLThemes Leedo leedo allows PHP Local File Inclusion.This issue affects Leedo: from n/a through <= 3.0.0.
- CVE-2026-57795HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themelexus Kitchor kitchor allows PHP Local File Inclusion.This issue affects Kitchor: from n/a through <= 1.4.3.
- CVE-2026-57794HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a throug…
- CVE-2026-57793HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Flow flow allows PHP Local File Inclusion.This issue affects Flow: from n/a through <= 1.8.
- CVE-2026-57792HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.1.
- CVE-2026-57791HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.
- CVE-2026-57789HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through <= 5.1.2.
- CVE-2026-57790HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through <= 2.1.8.
- CVE-2026-57788HIGHCVSS 7.5EG 7.52026-07-13
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Aalto aalto allows PHP Local File Inclusion.This issue affects Aalto: from n/a through <= 1.8.
- CVE-2026-15338HIGHCVSS 7.5EG 7.52026-07-11
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.1 via the get_type_template function. This makes it possible for authenticated attackers, with con…
- CVE-2026-57748HIGHCVSS 7.5EG 7.52026-07-02
Contributor Local File Inclusion in Shopify <= 1.0.0 versions.
- CVE-2026-57749HIGHCVSS 7.5EG 7.52026-07-02
Contributor Local File Inclusion in SportsPress Pro <= 2.7.29 versions.
- CVE-2025-69133HIGHCVSS 7.5EG 7.52026-07-02
Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.
- CVE-2026-12923HIGHCVSS 7.5EG 7.52026-07-01
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/comm…
- CVE-2026-57647HIGHCVSS 7.5EG 7.52026-06-26
Contributor Local File Inclusion in Panorama Viewer – 360 Degree Image + Video Viewer <= 1.6.1 versions.
- CVE-2025-68063HIGHCVSS 7.5EG 7.52026-06-26
Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
- CVE-2025-68064HIGHCVSS 7.5EG 7.52026-06-26
Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
- CVE-2026-40721HIGHCVSS 7.5EG 7.52026-06-17
Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.
- CVE-2025-49403HIGHCVSS 7.5EG 7.52026-06-17
Unauthenticated Arbitrary File Download in Premium Age Verification / Restriction for WordPress <= 3.0.2 versions.
- CVE-2025-58024HIGHCVSS 7.5EG 7.52026-06-02
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion. This issue affects Accordion FAQ: from n/a through 2.2.1.
- CVE-2026-48972HIGHCVSS 7.5EG 7.52026-05-27
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeedProd LLC SeedProd Pro allows PHP Local File Inclusion. This issue affects SeedProd Pro: from n/a before 6.19.5.
Map vulnerabilities like CWE-98 to your infrastructure
EchelonGraph correlates every CVE — across CWE-98 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →