CVE-2025-69xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

532 records · Page 5 of 6

• CVE-2025-69133: WordPress Tourmaster plugin <= 5.4.5 - Local File Inclusion vulnerability 7.5 High

  Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.

  Updated 2026-07-02
• CVE-2025-69132: WordPress Corpkit theme <= 1.0.5 - Sensitive Data Exposure vulnerability 6.5 Medium

  Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions.

  Updated 2026-07-02
• CVE-2025-69131: WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Download vulnerability 7.5 High

  Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

  Updated 2026-06-17
• CVE-2025-69130: WordPress Entrepreneur - Booking for Small Businesses WordPress Theme theme < 3.1.5 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injection. This issue affects Entrepreneur - Booking for Small Businesses WordPress Theme: from n/a before 3.1.5.

  Updated 2026-09-14
• CVE-2025-69129: WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin <= 1.0.7 - Arbitrary File Upload vulnerability 10.0 Critical

  Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7 versions.

  Updated 2026-06-17
• CVE-2025-69128: WordPress JobCareer theme <= 7.3 - Arbitrary File Deletion vulnerability 8.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCareer: from n/a through 7.3.

  Updated 2026-06-17
• CVE-2025-69127: WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

  Updated 2026-06-17
• CVE-2025-69126: WordPress Fortius theme <= 2.3.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

  Updated 2026-06-17
• CVE-2025-69125: WordPress Food Drop theme <= 1.3 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.

  Updated 2026-06-17
• CVE-2025-69124: WordPress Especio theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Especio <= 1.0 versions.

  Updated 2026-06-17
• CVE-2025-69123: WordPress Snow Club theme <= 1.1 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

  Updated 2026-06-17
• CVE-2025-69122: WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

  Updated 2026-06-17
• CVE-2025-69121: WordPress Deliciosa theme <= 1.10.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.

  Updated 2026-06-17
• CVE-2025-69120: WordPress Dazzle theme <= 1.0.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

  Updated 2026-06-17
• CVE-2025-69119: WordPress Corbesier theme <= 1.15.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.

  Updated 2026-06-17
• CVE-2025-69118: WordPress CopyPress theme <= 1.4.5 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.

  Updated 2026-06-17
• CVE-2025-69117: WordPress Ingenioso theme <= 1.14.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.

  Updated 2026-06-17
• CVE-2025-69116: WordPress Iona theme <= 1.0.8 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.

  Updated 2026-06-17
• CVE-2025-69115: WordPress LuxMed | Medicine & Healthcare Doctor WordPress Theme theme <= 1.2.2 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

  Updated 2026-06-17
• CVE-2025-69114: WordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.

  Updated 2026-06-17
• CVE-2025-69113: WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.

  Updated 2026-06-17
• CVE-2025-69112: WordPress Planty theme <= 1.14.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.

  Updated 2026-06-17
• CVE-2025-69111: WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

  Updated 2026-06-17
• CVE-2025-69110: WordPress AirSupply theme <= 2.0.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.

  Updated 2026-06-17
• CVE-2025-69109: WordPress Raider Spirit theme <= 1.1.2 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.

  Updated 2026-06-17
• CVE-2025-69108: WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability 9.8 Critical

  Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

  Updated 2026-06-17
• CVE-2025-69107: WordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.

  Updated 2026-06-17
• CVE-2025-69106: WordPress Imba theme <= 1.5.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

  Updated 2026-06-17
• CVE-2025-69105: WordPress Modernee theme <= 1.6.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.

  Updated 2026-06-17
• CVE-2025-69104: WordPress Qreatix theme <= 1.9.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Unauthenticated Cross Site Scripting (XSS) in Qreatix <= 1.9.4 versions.

  Updated 2026-06-17
• CVE-2025-69103: WordPress Brikk theme <= 3.0.0 - Arbitrary Content Deletion vulnerability 7.5 High

  Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.

  Updated 2026-06-17
• CVE-2025-69102: WordPress WP Test Email plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue affects WP Test Email: from n/a through <= 1.1.7.

  Updated 2026-04-28
• CVE-2025-69101: WordPress Workreap Core plugin <= 3.4.1 - Broken Authentication vulnerability 9.8 Critical

  Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.

  Updated 2026-04-28
• CVE-2025-69100: WordPress North theme <= 5.7.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North north-wp allows PHP Local File Inclusion.This issue affects North: from n/a through <= 5.7.5.

  Updated 2026-04-28
• CVE-2025-69099: WordPress North theme <= 5.7.5 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.

  Updated 2026-04-28
• CVE-2025-69098: WordPress Hide My WP plugin <= 6.2.12 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWave Hide My WP hide_my_wp allows Reflected XSS.This issue affects Hide My WP: from n/a through <= 6.2.12.

  Updated 2026-04-28
• CVE-2025-69097: WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability 8.6 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

  Updated 2026-04-28
• CVE-2025-69096: WordPress Zorka theme <= 1.5.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Zorka zorka allows Reflected XSS.This issue affects Zorka: from n/a through <= 1.5.7.

  Updated 2026-04-28
• CVE-2025-69095: WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability 6.5 Medium

  Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2025-69094: WordPress Unicamp theme <= 2.2.2 - SQL Injection vulnerability 8.5 High

  Subscriber SQL Injection in Unicamp <= 2.2.2 versions.

  Updated 2026-07-02
• CVE-2025-69093: WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.

  Updated 2026-04-28
• CVE-2025-69092: WordPress Essential Addons for Elementor plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows DOM-Based XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.3.

  Updated 2026-04-28
• CVE-2025-69091: WordPress Demo Importer Plus plugin <= 2.0.8 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.

  Updated 2026-04-28
• CVE-2025-69090: WordPress Remons theme <= 1.3.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Remons remons allows PHP Local File Inclusion.This issue affects Remons: from n/a through <= 1.3.4.

  Updated 2026-04-28
• CVE-2025-69089: WordPress Auto Listings plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XSS.This issue affects Auto Listings: from n/a through <= 2.7.1.

  Updated 2026-04-28
• CVE-2025-69088: WordPress Combo Offers WooCommerce plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows DOM-Based XSS.This issue affects Combo Offers WooCommerce: from n/a through <= 4.2.

  Updated 2026-04-28
• CVE-2025-69087: WordPress FreeAgent theme <= 2.1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent freeagent allows PHP Local File Inclusion.This issue affects FreeAgent: from n/a through <= 2.1.2.

  Updated 2026-04-28
• CVE-2025-69086: WordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Issabella issabella allows PHP Local File Inclusion.This issue affects Issabella: from n/a through <= 1.1.2.

  Updated 2026-04-28
• CVE-2025-69085: WordPress JobBank plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins JobBank jobbank allows Reflected XSS.This issue affects JobBank: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-69084: WordPress Photo Gallery plugin <= 2.7.7.26 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through <= 2.7.7.26.

  Updated 2026-04-28
• CVE-2025-69083: WordPress Frappé theme <= 1.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Frappé frappe allows PHP Local File Inclusion.This issue affects Frappé: from n/a through <= 1.8.

  Updated 2026-04-28
• CVE-2025-69082: WordPress Arlo theme <= 6.0.3 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.

  Updated 2026-04-28
• CVE-2025-69081: WordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.

  Updated 2026-04-28
• CVE-2025-69080: WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.

  Updated 2026-04-28
• CVE-2025-69079: WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.

  Updated 2026-04-28
• CVE-2025-69078: WordPress Malta theme <= 1.3.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Malta malta allows PHP Local File Inclusion.This issue affects Malta: from n/a through <= 1.3.3.

  Updated 2026-04-28
• CVE-2025-69077: WordPress Hobo theme <= 1.0.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hobo hobo allows PHP Local File Inclusion.This issue affects Hobo: from n/a through <= 1.0.10.

  Updated 2026-04-28
• CVE-2025-69076: WordPress Modern Housewife theme <= 1.0.12 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Modern Housewife modernhousewife allows PHP Local File Inclusion.This issue affects Modern Housewife: from n/a through <= 1.0.12.

  Updated 2026-04-28
• CVE-2025-69075: WordPress Yolox theme <= 1.0.15 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Yolox yolox allows PHP Local File Inclusion.This issue affects Yolox: from n/a through <= 1.0.15.

  Updated 2026-04-28
• CVE-2025-69074: WordPress Pearson Specter theme <= 1.11.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pearson Specter pearsonspecter allows PHP Local File Inclusion.This issue affects Pearson Specter: from n/a through <= 1.11.3.

  Updated 2026-04-28
• CVE-2025-69073: WordPress Piqes theme <= 1.0.11 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Piqes piqes allows PHP Local File Inclusion.This issue affects Piqes: from n/a through <= 1.0.11.

  Updated 2026-04-28
• CVE-2025-69072: WordPress Prider theme <= 1.1.3.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP Local File Inclusion.This issue affects Prider: from n/a through <= 1.1.3.1.

  Updated 2026-04-28
• CVE-2025-69071: WordPress TanTum theme <= 1.1.13 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes TanTum tantum allows PHP Local File Inclusion.This issue affects TanTum: from n/a through <= 1.1.13.

  Updated 2026-04-28
• CVE-2025-69070: WordPress Tornados theme <= 2.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tornados tornados allows PHP Local File Inclusion.This issue affects Tornados: from n/a through <= 2.1.

  Updated 2026-04-28
• CVE-2025-69068: WordPress Muji theme <= 1.2.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Muji muji allows PHP Local File Inclusion.This issue affects Muji: from n/a through <= 1.2.0.

  Updated 2026-04-28
• CVE-2025-69067: WordPress Tails theme <= 1.4.12 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tails tails allows PHP Local File Inclusion.This issue affects Tails: from n/a through <= 1.4.12.

  Updated 2026-04-28
• CVE-2025-69066: WordPress Indoor Plants theme <= 1.2.7 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Indoor Plants indoor-plants allows PHP Local File Inclusion.This issue affects Indoor Plants: from n/a through <= 1.2.7.

  Updated 2026-04-28
• CVE-2025-69065: WordPress Snow Mountain theme <= 1.4.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Snow Mountain snowmountain allows PHP Local File Inclusion.This issue affects Snow Mountain: from n/a through <= 1.4.3.

  Updated 2026-04-28
• CVE-2025-69064: WordPress Pets Land theme <= 1.2.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pets Land petsland allows PHP Local File Inclusion.This issue affects Pets Land: from n/a through <= 1.2.8.

  Updated 2026-04-28
• CVE-2025-69063: WordPress New User Approve plugin <= 3.2.0 - Broken Access Control vulnerability 8.6 High

  Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0.

  Updated 2026-04-28
• CVE-2025-69062: WordPress Weedles theme <= 1.1.12 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Weedles weedles allows PHP Local File Inclusion.This issue affects Weedles: from n/a through <= 1.1.12.

  Updated 2026-04-28
• CVE-2025-69061: WordPress MoveMe theme <= 1.2.15 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MoveMe moveme allows PHP Local File Inclusion.This issue affects MoveMe: from n/a through <= 1.2.15.

  Updated 2026-04-28
• CVE-2025-69060: WordPress uReach theme <= 1.3.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes uReach ureach allows PHP Local File Inclusion.This issue affects uReach: from n/a through <= 1.3.3.

  Updated 2026-04-28
• CVE-2025-69059: WordPress DiveIt theme <= 1.4.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DiveIt diveit allows PHP Local File Inclusion.This issue affects DiveIt: from n/a through <= 1.4.3.

  Updated 2026-04-28
• CVE-2025-69058: WordPress PartyMaker theme <= 1.1.15 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes PartyMaker partymaker allows PHP Local File Inclusion.This issue affects PartyMaker: from n/a through <= 1.1.15.

  Updated 2026-04-28
• CVE-2025-69057: WordPress Eldon theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Eldon eldon allows PHP Local File Inclusion.This issue affects Eldon: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-69056: WordPress Hotel Listing plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Hotel Listing hotel-listing allows Reflected XSS.This issue affects Hotel Listing: from n/a through <= 1.4.0.

  Updated 2026-04-28
• CVE-2025-69055: WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability 6.5 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.

  Updated 2026-04-28
• CVE-2025-69054: WordPress Super Logos Showcase plugin <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Logos Showcase superlogoshowcase-wp allows Reflected XSS.This issue affects Super Logos Showcase: from n/a through <= 2.8.

  Updated 2026-04-28
• CVE-2025-69053: WordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.4.

  Updated 2026-04-28
• CVE-2025-69052: WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerability 9.8 Critical

  Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for WooCommerce: from n/a through <= 1.3.1.

  Updated 2026-04-28
• CVE-2025-69051: WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through < 2.9.11.

  Updated 2026-04-28
• CVE-2025-69050: WordPress Overworld theme <= 1.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2025-69049: WordPress Töbel theme <= 1.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Töbel tobel allows PHP Local File Inclusion.This issue affects Töbel: from n/a through <= 1.6.

  Updated 2026-04-28
• CVE-2025-69048: WordPress Universal Video Player plugin <= 3.8.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XSS.This issue affects Universal Video Player: from n/a through <= 3.8.4.

  Updated 2026-04-28
• CVE-2025-69047: WordPress MaxShop theme <= 3.6.20 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech MaxShop sw_maxshop allows PHP Local File Inclusion.This issue affects MaxShop: from n/a through <= 3.6.20.

  Updated 2026-04-28
• CVE-2025-69046: WordPress iRecco Core plugin <= 1.3.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab iRecco Core irecco-core allows PHP Local File Inclusion.This issue affects iRecco Core: from n/a through <= 1.3.6.

  Updated 2026-04-28
• CVE-2025-69045: WordPress FooEvents for WooCommerce plugin <= 1.20.4 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FooEvents FooEvents for WooCommerce fooevents allows SQL Injection.This issue affects FooEvents for WooCommerce: from n/a through <= 1.20.4.

  Updated 2026-04-28
• CVE-2025-69044: WordPress Vango theme <= 1.3.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Vango vango allows PHP Local File Inclusion.This issue affects Vango: from n/a through <= 1.3.3.

  Updated 2026-04-28
• CVE-2025-69043: WordPress Rashy theme <= 1.1.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Rashy rashy allows PHP Local File Inclusion.This issue affects Rashy: from n/a through <= 1.1.3.

  Updated 2026-04-28
• CVE-2025-69042: WordPress Lindo theme <= 1.2.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Lindo lindo allows PHP Local File Inclusion.This issue affects Lindo: from n/a through <= 1.2.5.

  Updated 2026-04-28
• CVE-2025-69041: WordPress Dekoro theme <= 1.0.7 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Dekoro dekoro allows PHP Local File Inclusion.This issue affects Dekoro: from n/a through <= 1.0.7.

  Updated 2026-04-28
• CVE-2025-69040: WordPress Bfres theme <= 1.2.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bfres bfres allows PHP Local File Inclusion.This issue affects Bfres: from n/a through <= 1.2.1.

  Updated 2026-04-28
• CVE-2025-69039: WordPress Bailly theme <= 1.3.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Bailly bailly allows PHP Local File Inclusion.This issue affects Bailly: from n/a through <= 1.3.4.

  Updated 2026-04-28
• CVE-2025-69038: WordPress Hyori theme <= 1.3.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Hyori hyori allows PHP Local File Inclusion.This issue affects Hyori: from n/a through <= 1.3.6.

  Updated 2026-04-28
• CVE-2025-69037: WordPress Pippo theme <= 1.2.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Pippo pippo allows PHP Local File Inclusion.This issue affects Pippo: from n/a through <= 1.2.3.

  Updated 2026-04-28
• CVE-2025-69036: WordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in strongholdthemes Tech Life CPT techlife-cpt allows Object Injection.This issue affects Tech Life CPT: from n/a through <= 16.4.

  Updated 2026-04-28
• CVE-2025-69035: WordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.

  Updated 2026-10-26
• CVE-2025-69034: WordPress Lekker theme <= 1.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP Local File Inclusion.This issue affects Lekker: from n/a through <= 1.8.

  Updated 2026-04-28
• CVE-2025-69033: WordPress Blog Filter plugin <= 1.7.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.This issue affects Blog Filter: from n/a through <= 1.7.3.

  Updated 2026-04-28

Search a CVE ID or check dependency files →