File inclusion in WordPress plugins

File inclusion means the plugin can be made to load a file of the attacker’s choosing and run it as PHP. Local file inclusion uses a file already on the server; combined with an upload feature (even an image upload) it can lead to running code.

At minimum it can expose files on the server; at worst it leads to a full takeover.

What to do: update the plugin. If you ran a vulnerable version, check for unfamiliar files in wp-content/uploads and new admin users.

Worried a plugin bug was used on your site?

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Newest File inclusion records

279 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

medium 6.5 Unlimited Elements for Elementor

File inclusion

CVE-2026-62121 · affected 2.0.26 and older · fixed in 2.0.27 · published 2026-10-30
medium 5.9 Bit Flows

File inclusion

CVE-2026-110185 · affected 1.31.0 and older · fixed in 1.32.0 * · published 2026-10-28
critical 9.8 Rootblox

File inclusion

CVE-2026-112832 · affected 1.0.6 and older · fixed in 1.0.7 · published 2026-10-22
medium 6.5 WP Mailster

File inclusion

CVE-2026-111829 · affected 1.9.1.0 and older · fixed in 1.9.2.0 · published 2026-10-19
high 7.5 LifterLMS

File inclusion

CVE-2026-110284 · affected 10.3.1 and older · fixed in 10.3.2 * · published 2026-10-14
high 8.1 Mang Board

File inclusion

CVE-2026-104909 · affected 2.4.3 and older · fixed in 2.4.4 * · published 2026-10-14
high 8.1 ShopMagic

File inclusion

CVE-2026-103367 · affected 4.9.0 and older · fixed in 4.9.1-beta.1 * · published 2026-10-14
critical 9.8 affects latest 3.6.27 DirectoryPress

File inclusion

CVE-2026-62032 · affected 3.6.27 and older · no fix listed yet · published 2026-10-10
high 8.1 GeoDirectory

File inclusion

CVE-2026-104899 · affected 2.8.187 and older · fixed in 2.8.188 * · published 2026-10-10
high 7.5 WPCafe

File inclusion

CVE-2026-75028 · affected 3.0.18 and older · fixed in 3.0.19 * · published 2026-10-03
high 7.5 SiteOrigin Widgets Bundle

File inclusion

CVE-2026-92174 · affected 1.73.2 and older · fixed in 1.74.0 * · published 2026-10-02
high 7.5 Simply Schedule Appointments

File inclusion

CVE-2026-89294 · affected 1.6.12.27 and older · fixed in 1.6.12.29 * · published 2026-09-30
high 7.5 WP Maps

File inclusion

CVE-2026-13456 · affected 4.9.8 and older · fixed in 4.9.9 * · published 2026-09-25
critical 9.8 Visual Composer Website Builder

File inclusion

CVE-2026-12227 · affected 45.16.0 and older · fixed in 45.16.1 * · published 2026-09-24
high 7.5 WP Travel Engine

File inclusion

CVE-2026-9231 · affected 6.8.0 and older · fixed in 6.8.1 * · published 2026-09-22
high 8.1 HUSKY

File inclusion

CVE-2026-92969 · affected 1.4.4 and older · fixed in 1.4.5 * · published 2026-09-22
medium 6.6 All Bootstrap Blocks

File inclusion

CVE-2026-88994 · affected 1.3.20 to 1.3.31 · fix not stated · published 2026-09-18
high 7.5 Eventin

File inclusion

CVE-2026-15667 · affected 4.1.22 and older · fixed in 4.1.23 * · published 2026-09-09
high 7.5 Eventin

File inclusion

CVE-2026-15406 · affected 4.1.22 and older · fixed in 4.1.23 * · published 2026-09-09
medium 6.6 Events Manager

File inclusion

CVE-2026-14280 · affected 7.3.7.4 and older · fixed in 7.3.7.4.1 * · published 2026-08-25
high 7.5 Events Made Easy

File inclusion

CVE-2026-75963 · affected 3.2.5 and older · fixed in 3.2.6 * · published 2026-08-20
high 8.1 Restaurant Menu and Food Ordering

File inclusion

CVE-2026-73400 · affected 2.4.11 and older · fixed in 2.4.12 * · published 2026-08-18
high 7.2 Easy Google Maps by Supsystic

File inclusion

CVE-2026-73367 · affected older than 1.14.2 · fixed in 1.14.2 · published 2026-08-18
high 8.1 affects latest 2.9.1 Theme Test Drive

File inclusion

CVE-2026-32464 · affected 2.9.1 and older · no fix listed yet · published 2026-08-18
high 8.1 Geo Mashup

File inclusion

CVE-2026-66450 · affected 1.13.18 and older · fixed in 1.13.19 · published 2026-08-13
high 8.8 WP Maps

File inclusion

CVE-2026-16263 · affected older than 4.9.7 · fixed in 4.9.7 · published 2026-08-07
high 8.1 E2Pdf

File inclusion

CVE-2026-66710 · affected 1.32.40 and older · fixed in 1.32.43 · published 2026-08-06
medium 6.6 Payment forms, Buy now buttons, and Invoicing…

File inclusion

CVE-2026-17605 · affected 2.8.56 and older · fixed in 2.8.57 * · published 2026-08-01
high 7.2 Planyo online reservation system

File inclusion

CVE-2026-3576 · affected 3.0 and older · fixed in 3.1 * · published 2026-07-11
high 7.5 LA-Studio Element Kit for Elementor

File inclusion

CVE-2026-15338 · affected 1.6.1 and older · fixed in 1.6.2 * · published 2026-07-11
medium 6.6 Happyforms

File inclusion

CVE-2025-11977 · affected 1.26.12 and older · fixed in 1.26.13 * · published 2026-07-10
medium 6.6 WPFunnels

File inclusion

CVE-2026-13080 · affected 3.12.7 and older · fixed in 3.12.8 * · published 2026-07-09
medium 4.3 RTMKit for Elementor

File inclusion

CVE-2026-5137 · affected 2.0.7 and older · fixed in 2.0.8 * · published 2026-07-03
high 7.5 Panorama

File inclusion

CVE-2026-57647 · affected 1.6.1 and older · fixed in 1.7.0 · published 2026-06-26
high 8.1 MDTF

File inclusion

CVE-2026-54845 · affected 1.3.8 and older · fixed in 1.3.9 · published 2026-06-25
high 8.1 Motors

File inclusion

CVE-2026-54814 · affected 1.4.109 and older · fixed in 1.4.110 · published 2026-06-17
high 8.1 Recover Exit For WooCommerce

File inclusion

CVE-2026-9662 · affected 1.0.3 and older · fix not stated · published 2026-06-09
high 7.5 WP User Manager

File inclusion

CVE-2026-9290 · affected 2.9.17 and older · fixed in 2.9.18 * · published 2026-06-06
high 7.5 Query Shortcode

File inclusion

CVE-2026-9200 · affected 0.2.1 and older · fix not stated · published 2026-05-27
high 7.5 WP Maps

File inclusion

CVE-2026-6381 · affected older than 4.9.3 · fixed in 4.9.3 · published 2026-05-18
high 8.8 RTMKit for Elementor

File inclusion

CVE-2026-3425 · affected 2.0.2 and older · fixed in 2.0.3 * · published 2026-05-13
high 8.8 Livemesh Addons by Elementor

File inclusion

CVE-2026-1620 · affected 9.0 and older · fix not stated · published 2026-04-16
high 7.5 Gallery by Visual Portfolio

File inclusion

CVE-2026-32537 · affected 3.5.1 and older · fixed in 3.5.2 · published 2026-03-25
high 8.1 Mixtape

File inclusion

CVE-2026-25457 · affected 2.1 and older · fix not stated · published 2026-03-25
high 8.8 Photo Gallery, Sliders, Proofing and Themes

File inclusion

CVE-2026-1463 · affected 4.0.4 and older · fixed in 4.0.5 * · published 2026-03-18
high 7.2 Sprout Invoices

File inclusion

CVE-2026-32401 · affected 20.8.9 and older · fixed in 20.8.10 · published 2026-03-13
high 7.5 Appointment Booking Plugin for WooCommerce

File inclusion

CVE-2026-32384 · affected 1.2.9 and older · fixed in 1.3.0 · published 2026-03-13
high 7.5 wpDataTables

File inclusion

CVE-2026-28039 · affected 6.5.0.1 and older · fixed in 6.5.0.2 · published 2026-03-05
high 8.8 Page Builder by SiteOrigin

File inclusion

CVE-2026-2448 · affected 2.33.5 and older · fixed in 2.34.0 * · published 2026-03-03
high 7.5 Jetpack CRM

File inclusion

CVE-2026-22356 · affected 6.7.0 and older · fixed in 6.7.1 · published 2026-02-20
high 7.5 affects latest 4.2.1 Simple Retail Menus

File inclusion

CVE-2025-69387 · affected 4.2.1 and older · no fix listed yet · published 2026-02-20
high 7.5 affects latest 2.6.1 WPshop 2

File inclusion

CVE-2025-69383 · affected 2.6.1 and older · no fix listed yet · published 2026-02-20
high 8.1 Eleblog

File inclusion

CVE-2025-69374 · affected 2.0.3 and older · fix not stated · published 2026-02-20
high 7.5 Topper Pack

File inclusion

CVE-2025-68841 · affected 1.2.1 and older · fixed in 1.2.2 * · published 2026-02-20
high 8.1 Extensive VC Addons for WPBakery Page Builder

File inclusion

CVE-2025-60087 · affected 1.9.1 and older · fixed in 2.0 * · published 2026-02-20
critical 9.8 Prodigy Commerce

File inclusion

CVE-2026-0926 · affected 3.3.0 and older · fixed in 3.3.1 * · published 2026-02-19
high 7.5 Flexi Product Slider and Grid for WooCommerce

File inclusion

CVE-2026-1988 · affected 1.0.5 and older · fix not stated · published 2026-02-14
high 8.8 SportsPress

File inclusion

CVE-2025-15368 · affected 2.7.26 and older · fixed in 2.7.27 * · published 2026-02-04
high 7.5 Administrative Shortcodes

File inclusion

CVE-2026-1257 · affected 0.3.4 and older · fix not stated · published 2026-01-24
high 7.5 affects latest 1.6.7 Omnipress

File inclusion

CVE-2026-24538 · affected 1.6.7 and older · no fix listed yet · published 2026-01-23
high 7.5 My auctions allegro

File inclusion

CVE-2026-22464 · affected 3.6.33 and older · fixed in 3.6.34 · published 2026-01-22
critical 9.8 News and Blog Designer Bundle

File inclusion

CVE-2025-14502 · affected 1.1 and older · fix not stated · published 2026-01-14
high 7.5 MAS Videos

File inclusion

CVE-2025-62753 · affected 1.3.4 and older · fixed in 1.3.5 * · published 2025-12-30
medium 6.6 Social Login, Social Sharing by miniOrange

File inclusion

CVE-2025-68974 · affected 7.7.0 and older · fixed in 7.8.0 * · published 2025-12-30
high 7.5 affects latest 1.0.0 CookieHint WP

File inclusion

CVE-2025-68870 · affected 1.0.0 and older · no fix listed yet · published 2025-12-29
high 7.5 affects latest 1.0.6 CedCommerce Integration for Good Market

File inclusion

CVE-2025-68877 · affected 1.0.6 and older · no fix listed yet · published 2025-12-29
high 7.5 Subscribe to Unlock Lite

File inclusion

CVE-2025-68563 · affected 1.3.0 and older · fixed in 1.3.1 · published 2025-12-24
high 8.1 Docket Cache

File inclusion

CVE-2025-68506 · affected 24.07.03 and older · fixed in 24.07.04 · published 2025-12-24
high 8.1 affects latest 1.0.2 Anchor smooth scroll

File inclusion

CVE-2025-60072 · affected 1.0.2 and older · no fix listed yet · published 2025-12-18
high 7.5 Ray Enterprise Translation

File inclusion

CVE-2025-60076 · affected 1.7.1 and older · fixed in 1.7.2 · published 2025-12-18
high 7.5 Task Manager

File inclusion

CVE-2025-60078 · affected 3.0.2 and older · fix not stated · published 2025-12-18
high 8.1 Extensive VC Addons for WPBakery Page Builder

File inclusion

CVE-2025-14475 · affected 1.9.1 and older · fixed in 2.0 * · published 2025-12-13
high 7.5 LT Unleashed

File inclusion

CVE-2025-13886 · affected 1.1.1 and older · fix not stated · published 2025-12-12
high 8.1 My auctions allegro

File inclusion

CVE-2025-12851 · affected 3.6.32 and older · fixed in 3.6.33 * · published 2025-12-05
medium 6.6 Easy Invoice

File inclusion

CVE-2025-66115 · affected 2.1.4 and older · fixed in 2.1.5 · published 2025-11-21
high 8.8 Product Filter

File inclusion

CVE-2025-13088 · affected 1.0 and older · fix not stated · published 2025-11-18
high 7.5 Simple Payment

File inclusion

CVE-2025-62075 · affected 2.4.6 and older · fixed in 2.4.7 · published 2025-11-06
high 7.5 WPC Product Options for WooCommerce

File inclusion

CVE-2025-60248 · affected 3.1.3 and older · fixed in 3.1.3 · published 2025-11-06
high 7.5 AnyComment

File inclusion

CVE-2025-60240 · affected 0.3.6 and older · fix not stated · published 2025-11-06
high 7.5 Premmerce

File inclusion

CVE-2025-60241 · affected 1.3.19 and older · fixed in 1.3.20 · published 2025-11-06
high 7.5 Store Toolkit

File inclusion

CVE-2025-60204 · affected 2.4.3 and older · fixed in 2.4.4 · published 2025-11-06
high 7.5 WP Customer Area

File inclusion

CVE-2025-60201 · affected older than 8.3.4 · fixed in 8.3.4 · published 2025-11-06
high 7.5 Favorites

File inclusion

CVE-2025-60202 · affected 2.3.6 and older · fixed in 2.3.7 * · published 2025-11-06
high 7.5 LearnPress

File inclusion

CVE-2025-60200 · affected 4.1.2 and older · fixed in 4.1.3 · published 2025-11-06
high 7.5 Store Exporter

File inclusion

CVE-2025-60203 · affected 2.7.6 and older · fixed in 2.7.7 · published 2025-11-06
high 7.5 Clearblue® Ovulation Calculator

File inclusion

CVE-2025-60196 · affected 1.2.4 and older · fix not stated · published 2025-11-06
high 7.5 Premmerce Product Search for WooCommerce

File inclusion

CVE-2025-60194 · affected 2.2.4 and older · fixed in 2.2.5 · published 2025-11-06
high 7.5 Premmerce User Roles

File inclusion

CVE-2025-60193 · affected 1.0.13 and older · fixed in 1.0.14 · published 2025-11-06
high 7.5 Premmerce Wholesale Pricing for WooCommerce

File inclusion

CVE-2025-60192 · affected 1.1.10 and older · fixed in 1.1.11 · published 2025-11-06
high 7.5 Premmerce Wishlist for WooCommerce

File inclusion

CVE-2025-60191 · affected 1.1.10 and older · fixed in 1.1.11 · published 2025-11-06
high 8.1 affects latest 1.6.4 Simple Contact Forms

File inclusion

CVE-2025-60197 · affected 1.6.4 and older · no fix listed yet · published 2025-11-06
high 8.1 affects latest 1.3.6 Immocaster WordPress Plugin

File inclusion

CVE-2025-60190 · affected 1.3.6 and older · no fix listed yet · published 2025-11-06
high 7.5 affects latest 1.4.7 Lazy Load Optimizer

File inclusion

CVE-2025-60074 · affected 1.4.7 and older · no fix listed yet · published 2025-11-06
high 7.5 affects latest 1.2.2 Responsive Sidebar

File inclusion

CVE-2025-60073 · affected 1.2.2 and older · no fix listed yet · published 2025-11-06
high 7.5 PoloPag

File inclusion

CVE-2025-60189 · affected 2.0.9 and older · fixed in 3.0.0 · published 2025-11-06
high 7.5 affects latest 1.7.0 Real Time Validation for Gravity Forms

File inclusion

CVE-2025-48330 · affected 1.7.0 and older · no fix listed yet · published 2025-11-06
high 8.1 Premium Portfolio Features for Phlox theme

File inclusion

CVE-2025-12497 · affected 2.3.10 and older · fixed in 2.3.12 * · published 2025-11-05
critical 9.8 ShopLentor

File inclusion

CVE-2025-12493 · affected 3.2.5 and older · fixed in 3.2.6 * · published 2025-11-04
high 7.5 Elegance Menu

File inclusion

CVE-2025-11704 · affected 1.9 and older · fixed in 1.9.1 * · published 2025-11-04
high 8.8 WPCOM Member

File inclusion

CVE-2025-11920 · affected 1.7.14 and older · fixed in 1.7.20 * · published 2025-11-01

Other types

Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · Authentication bypass · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan