CWE-98 vulnerabilities

CVE-2025-69120 is a high-severity vulnerability in ThemeREX Dazzle versions up to and including 1.0.0. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements in PHP. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2025-69115 is a high-severity vulnerability in the ThemeREX LuxMed | Medicine & Healthcare Doctor WordPress Theme affecting versions up to and including 1.2.2. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2025-69106 is a high-severity vulnerability in ThemeREX Imba versions up to and including 1.5.0. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This vulnerability could lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-40731 is a high-severity vulnerability affecting Mikado-Themes ChapterOne versions up to and including 1.7. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Element Pack Pro versions up to and including 9.0.6 contain a vulnerability classified as CWE-98, involving improper control of filenames in include/require statements. This flaw allows for local file inclusion, which can lead to remote file inclusion attacks. The vulnerability has a high severity with a CVSS score of 7.5, indicating a significant risk to confidentiality, integrity, and availability if exploited.

CVE-2026-39582 is a high-severity vulnerability affecting xtemos Hitek versions prior to 1.8.3. It involves an unauthenticated Local File Inclusion (LFI) issue due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This vulnerability allows an attacker to include local files without authentication, potentially leading to full compromise of confidentiality, integrity, and availability. No official patch or remediation has been confirmed yet.

CVE-2026-39558 is a high severity vulnerability in Elated-Themes Malmö versions up to and including 2.2. It is an unauthenticated local file inclusion (LFI) issue caused by improper control of filenames used in include or require statements in PHP. This flaw allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.

CVE-2026-22338 is a high-severity vulnerability in ThemeREX EcoBlue versions up to and including 1.15. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which allows improper control of filenames in include/require statements in PHP. This flaw can lead to remote file inclusion attacks, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.

CVE-2026-22330 is a high severity vulnerability in Themeum's Right Way product, affecting versions up to and including 4.0. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include/require statements in PHP. This flaw allows an attacker to include local files remotely, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

AxiomThemes Reprizo versions up to and including 1.0.8 are affected by an unauthenticated Local File Inclusion (LFI) vulnerability. This vulnerability involves improper control of filenames in include/require statements in PHP, classified as CWE-98. It allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 8.1.

Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.

Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.

CVE-2025-69172 is a high-severity vulnerability affecting ThemeREX Resurs versions up to and including 1.3. It involves an unauthenticated Local File Inclusion (LFI) issue due to improper control of filenames used in include/require statements in PHP. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

CVE-2025-69161 is a high-severity vulnerability in ThemeREX Snowy versions 1.13 and earlier that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This vulnerability can lead to remote file inclusion attacks, potentially resulting in complete compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

CVE-2025-69145 is a high-severity vulnerability affecting ThemeREX Gat versions up to and including 1.16. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP code. This vulnerability can lead to remote file inclusion attacks, potentially allowing attackers to execute arbitrary code, compromise confidentiality, integrity, and availability of the affected system.

CVE-2025-69117 is a high-severity vulnerability in ThemeREX Ingenioso versions up to and including 1.14.0. It involves an unauthenticated Local File Inclusion (LFI) due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This flaw allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.