Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,358

Export CSV
CVE-2026-54814

WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Motors Wordpress
CVE-2016-20077

WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php

WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Kaymeephotography Wordpress
Products
Photocart Link Wordpress
CVE-2016-20079

WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php

WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jamie Wordpress
Products
Dharma Booking Wordpress
CVE-2016-20080

WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php

WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Brandfolder Wordpress
Products
Brandfolder Wordpress
CVE-2016-20082

WordPress Plugin Abtest Local File Inclusion via abtest_admin.php

WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Abtest Wordpress
Products
Abtest Wordpress
CVE-2025-69149

WordPress Top Dog theme <= 1.0.5 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themerex Wordpress
Products
Top Dog Wordpress
CVE-2026-7515

BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style

The BetterDocs Pro plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 3.8.0 via the `doc_style` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Betterdocs Wordpress
Products
Betterdocs Pro Wordpress