CWE-98 · File and Path Handling
PHP File Inclusion
1,349CVEs
2exploited
15with a public check
6likely (EPSS 10%+)
SortMost likely exploited
1,349 CVEs with CWE-98 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-87902In CISA KEVExploitedWordPress Core - PHP Template Path TraversalWordPress · WordPress · CVSS 8.1 · 2026-09-22 | 8.1 | 96% | 2026-09-22 |
| CVE-2025-68645In CISA KEVExploitedZimbra Collaboration - Local File InclusionSynacor · Zimbra Collaboration Suite (ZCS) · CVSS 8.8 · 2025-12-22 | 8.8 | 51% | 2025-12-22 |
| CVE-2023-6989CheckShield Security WP Plugin <= 18.5.9 - Local File Inclusionpaultgoodchild · Shield: Blocks Bots, Protects Users, and Prevents Security Breaches · CVSS 9.8 · 2024-02-05 | 9.8 | 57% | 2024-02-05 |
| CVE-2025-4380CheckAds Pro Plugin <= 4.89 - Local File Inclusionscripteo · Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager · CVSS 8.1 · 2025-07-02 | 8.1 | 43% | 2025-07-02 |
| CVE-2024-12209CheckWP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusionwphealth · WP Umbrella: Update Backup Restore & Monitoring · CVSS 9.8 · 2024-12-08 | 9.8 | 23% | 2024-12-08 |
| CVE-2026-0926CheckProdigy Commerce <= 3.3.0 - Local File Inclusionprodigycommerce · Prodigy Commerce · CVSS 9.8 · 2026-02-19 | 9.8 | 9.3% | 2026-02-19 |
| CVE-2023-3452CheckWordPress Canto Plugin <= 3.0.4 - File Inclusionflightbycanto · Canto · CVSS 9.8 · 2023-08-12 | 9.8 | 7.0% | 2023-08-12 |
| CVE-2023-5815CheckNews & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusioninfornweb · Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post… · CVSS 8.1 · 2023-11-22 | 8.1 | 5.0% | 2023-11-22 |
| CVE-2024-3136CheckMasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via templatestylemix · MasterStudy LMS WordPress Plugin – for Online Courses and Education · CVSS 9.8 · 2024-04-09 | 9.8 | 5.0% | 2024-04-09 |
| CVE-2024-10571CheckChartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusionays-pro · Chartify – WordPress Chart Plugin · CVSS 9.8 · 2024-11-14 | 9.8 | 4.8% | 2024-11-14 |
| CVE-2024-9193CheckWHMpress <= 6.3-revision-0 - Unauthenticated Local File Inclusion to Arbitrary Options Updatecreativeon · WHMpress - WHMCS WordPress Integration Plugin · CVSS 9.8 · 2025-02-28 | 9.8 | 3.3% | 2025-02-28 |
| CVE-2026-85200CheckGEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusionninjew · GEO my WP · CVSS 7.5 · 2026-09-12 | 7.5 | 3.2% | 2026-09-12 |
| CVE-2024-8252CheckWordPress Clean Login <= 1.14.5 Authenticated (Contributor+) - Local File Inclusionhornero · Clean Login · CVSS 8.8 · 2024-08-30 | 8.8 | 3.0% | 2024-08-30 |
| CVE-2025-48157CheckWordPress Formality Plugin <= 1.5.9 - Local File InclusionMichele Giorgi · Formality · CVSS 8.1 · 2025-08-20 | 8.1 | 2.9% | 2025-08-20 |
| CVE-2026-12227CheckVisual Composer <= 45.16.0 - Unauthenticated LFIvisualcomposer · Visual Composer Website Builder · CVSS 9.8 · 2026-09-24 | 9.8 | 2.8% | 2026-09-24 |
| CVE-2025-32614CheckEventON Lite <= 2.4 - Authenticated Local File InclusionAshan Perera · EventON · CVSS 8.8 · 2025-04-11 | 8.8 | 1.9% | 2025-04-11 |
| CVE-2026-34036CheckDolibarr <=22.0.4 - Local File InclusionDolibarr · dolibarr · CVSS 6.5 · 2026-03-31 | 6.5 | 1.5% | 2026-03-31 |
| CVE-2024-5762Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution VulnerabilityZen Cart · Zen Cart · CVSS 8.1 · 2024-08-21 | 8.1 | 72% | 2024-08-21 |
| CVE-2023-49084Local File Inclusion (RCE) in CactiCacti · cacti · CVSS 8.1 · 2023-12-21 | 8.1 | 64% | 2023-12-21 |
| CVE-2023-2249wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contentstomdever · wpForo Forum · CVSS 8.8 · 2023-06-09 | 8.8 | 61% | 2023-06-09 |
| CVE-2022-4606PHP Remote File Inclusion in flatpressblog/flatpressflatpressblog · flatpressblog/flatpress · CVSS 8.8 · 2022-12-18 | 8.8 | 35% | 2022-12-18 |
| CVE-2024-1600Local File Inclusion in parisneo/lollms-webuiparisneo · parisneo/lollms-webui · CVSS 9.3 · 2024-04-10 | 9.3 | 33% | 2024-04-10 |
| CVE-2017-14095A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion o…Trend Micro · Trend Micro Smart Protection Server (Standalone) · 2018-01-19 | – | 12% | 2018-01-19 |
| CVE-2020-5295Local File read vulnerability in OctoberCMSoctobercms · october · CVSS 4.8 · 2020-06-03 | 4.8 | 7.4% | 2020-06-03 |
| CVE-2023-6971The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthent…migrate · Backup Migration · CVSS 8.1 · 2023-12-23 | 8.1 | 6.4% | 2023-12-23 |
| CVE-2023-24217AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.Agilebio · Electronic Lab Notebook · CVSS 8.8 · 2023-03-06 | 8.8 | 4.5% | 2023-03-06 |
| CVE-2023-52325A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on affected installations. Please note: t…Trend Micro, Inc. · Trend Micro Apex Central · CVSS 7.5 · 2024-01-23 | 7.5 | 4.5% | 2024-01-23 |
| CVE-2026-48133Identity Awareness Captive Portal - Unauthenticated Local File Inclusioncheckpoint · Quantum Security Gateway · CVSS 7.5 · 2026-05-26 | 7.5 | 4.5% | 2026-05-26 |
| CVE-2021-21804A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to…Advantech · Advantech · CVSS 8.1 · 2021-07-16 | 8.1 | 3.7% | 2021-07-16 |
| CVE-2014-9186A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x before R430.2, which could lead to accepti…Honeywell · Experion PKS · 2019-04-08 | – | 3.6% | 2019-04-08 |
| CVE-2021-22968A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The externa…Concretecms · https://github.com/concrete5/concrete5 · 2021-11-19 | – | 3.2% | 2021-11-19 |
| CVE-2022-40089A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploitable whe…Simple College Website Project · Simple College Website · CVSS 9.8 · 2022-09-22 | 9.8 | 2.7% | 2022-09-22 |
| CVE-2024-3806Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_postsP-THEMES · Porto · CVSS 9.8 · 2024-05-09 | 9.8 | 2.7% | 2024-05-09 |
| CVE-2024-31459Cacti RCE vulnerability by file include in lib/plugin.phpCacti · cacti · CVSS 8.1 · 2024-05-13 | 8.1 | 2.7% | 2024-05-13 |
| CVE-2016-6565The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 may execute code from an uploaded malicious fileImagely · NextGen Gallery plugin · 2018-07-13 | – | 2.5% | 2018-07-13 |
| CVE-2015-10133Subscribe to Comments <= 2.1.2 - Local File Includionmarkjaquith · Subscribe to Comments · CVSS 7.2 · 2025-07-19 | 7.2 | 2.4% | 2025-07-19 |
| CVE-2012-10025WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File InclusionAdvanced Custom Fields · WordPress Plugin · CVSS 10 · 2025-08-05 | 10.0 | 2.1% | 2025-08-05 |
| CVE-2023-2551PHP Remote File Inclusion in unilogies/bumsysunilogies · unilogies/bumsys · CVSS 7.2 · 2023-05-05 | 7.2 | 1.9% | 2023-05-05 |
| CVE-2024-32523WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerabilityEverPress · Mailster · CVSS 8.1 · 2024-05-17 | 8.1 | 1.8% | 2024-05-17 |
| CVE-2023-31718FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.Frangoteam · Fuxa · 2023-09-21 | – | 1.7% | 2023-09-21 |
| CVE-2024-3849Click to Chat – HoliThemes <= 3.35 - Authenticated (Contributor+) Local File Inclusionholithemes · Click to Chat – HoliThemes · CVSS 8.8 · 2024-05-02 | 8.8 | 1.7% | 2024-05-02 |
| CVE-2023-5199PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcodebloafer · PHP to Page · CVSS 9.9 · 2023-10-30 | 9.9 | 1.7% | 2023-10-30 |
| CVE-2024-14002Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVisNagios · XI · CVSS 7.1 · 2025-10-30 | 7.1 | 1.7% | 2025-10-30 |
| CVE-2020-13175The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector)…Teradici · - Cloud Access Connector - Cloud Access Connector Legacy · 2020-08-11 | – | 1.7% | 2020-08-11 |
| CVE-2025-0366Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)artbees · Jupiter X Core · CVSS 8.8 · 2025-02-01 | 8.8 | 1.6% | 2025-02-01 |
| CVE-2024-2411MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modalstylemix · MasterStudy LMS WordPress Plugin – for Online Courses and Education · CVSS 9.8 · 2024-03-29 | 9.8 | 1.5% | 2024-03-29 |
| CVE-2024-3807Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post MetaP-THEMES · Porto · CVSS 8.8 · 2024-05-09 | 8.8 | 1.5% | 2024-05-09 |
| CVE-2022-41547Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability a…Opensecurity · Mobile Security Framework · CVSS 7.5 · 2022-10-18 | 7.5 | 1.5% | 2022-10-18 |
| CVE-2025-14502News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusionvaghasia3 · News and Blog Designer Bundle · CVSS 9.8 · 2026-01-14 | 9.8 | 1.5% | 2026-01-14 |
| CVE-2024-2047ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_rawroxnor · ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor · CVSS 8.8 · 2024-03-30 | 8.8 | 1.5% | 2024-03-30 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.