Skip to content
BackEsc
Sign in

CWE-98 · weakness in File and Path Handling

PHP File Inclusion

1,349 CVEs · 2 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
2
check available
15
likely to be exploited
6

Every one of the 1,349 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. WordPress Core - PHP Template Path TraversalCVE-2026-87902WordPress · CVSS 8.1 · 96% likelycovered by CyberSIXT

    WordPress10 articles

  2. Zimbra Collaboration - Local File InclusionCVE-2025-68645Synacor · CVSS 8.8 · 51% likelycovered by CyberSIXT

    Zimbra

  3. Shield Security WP Plugin <= 18.5.9 - Local File InclusionCVE-2023-6989paultgoodchild · CVSS 9.8 · 57% likely

    Paultgoodchild

  4. Ads Pro Plugin <= 4.89 - Local File InclusionCVE-2025-4380scripteo · CVSS 8.1 · 43% likely

    Scripteo

  5. WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File InclusionCVE-2024-12209wphealth · CVSS 9.8 · 23% likely
  6. Prodigy Commerce <= 3.3.0 - Local File InclusionCVE-2026-0926prodigycommerce · CVSS 9.8 · 9.3% likely
  7. WordPress Canto Plugin <= 3.0.4 - File InclusionCVE-2023-3452flightbycanto · CVSS 9.8 · 7.0% likely
  8. News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File InclusionCVE-2023-5815infornweb · CVSS 8.1 · 5.0% likely
  9. MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via templateCVE-2024-3136stylemix · CVSS 9.8 · 5.0% likely

    Stylemix

  10. Chartify – WordPress Chart Plugin < 2.9.6 - Local File InclusionCVE-2024-10571ays-pro · CVSS 9.8 · 4.8% likely

    Ays Pro

  11. WHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options UpdateCVE-2024-9193creativeon · CVSS 9.8 · 3.3% likely
  12. GEO my WP <=4.5.5.3 - Unauthenticated Local File InclusionCVE-2026-85200ninjew · CVSS 7.5 · 3.2% likely
  13. WordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File InclusionCVE-2024-8252hornero · CVSS 8.8 · 3.0% likely
  14. WordPress Formality Plugin <= 1.5.9 - Local File InclusionCVE-2025-48157Michele Giorgi · CVSS 8.1 · 2.9% likely
  15. Visual Composer <= 45.16.0 - Unauthenticated LFICVE-2026-12227visualcomposer · CVSS 9.8 · 2.8% likely

    Visual Composer

  16. EventON Lite <= 2.4 - Authenticated Local File InclusionCVE-2025-32614Ashan Perera · CVSS 8.8 · 1.9% likely

    Ashan Perera

  17. Dolibarr <=22.0.4 - Local File InclusionCVE-2026-34036Dolibarr · CVSS 6.5 · 1.5% likely

    Dolibarr

  18. Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution VulnerabilityCVE-2024-5762Zen Cart · CVSS 8.1 · 72% likely
  19. Local File Inclusion (RCE) in CactiCVE-2023-49084Cacti · CVSS 8.1 · 64% likely

    Cacti

  20. wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contentsCVE-2023-2249tomdever · CVSS 8.8 · 61% likely

    Tomdever

  21. PHP Remote File Inclusion in flatpressblog/flatpressCVE-2022-4606flatpressblog · CVSS 8.8 · 35% likely

    Flatpressblog

  22. Local File Inclusion in parisneo/lollms-webuiCVE-2024-1600parisneo · CVSS 9.3 · 33% likely

    ParisNeo

  23. A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion o…CVE-2017-14095Trend Micro · 12% likely

    Trend Micro

  24. Local File read vulnerability in OctoberCMSCVE-2020-5295octobercms · CVSS 4.8 · 7.4% likely

    October CMS

  25. The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthent…CVE-2023-6971migrate · CVSS 8.1 · 6.4% likely

    Migrate

  26. AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.CVE-2023-24217CVSS 8.8 · 4.5% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in