CWE-98 vulnerabilities

368 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.1	EPSS 0.4%	CVE-2025-69110AirSupply (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-17CVE Database V5CVE-2025-69110 Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-17
High	8.1	EPSS 0.4%	CVE-2025-58954HomeRoofer (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-17CVE Database V5CVE-2025-58954 Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-17
High	8.1	EPSS 0.4%	CVE-2025-58953Joly (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-17CVE Database V5CVE-2025-58953 CVE-2025-58953 is a high-severity vulnerability in ThemeREX Joly versions up to and including 1.22.0. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This can lead to remote file inclusion attacks. The vulnerability has a CVSS score of 8.1, indicating a significant risk to confidentiality, integrity, and availability. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-17
High	8.1	EPSS 0.3%	CVE-2025-58952Neuronet (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-17CVE Database V5CVE-2025-58952 Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-17
High	7.5	EPSS 0.3%	CVE-2025-49403AA-Team Premium Age Verification / Restriction for WordPress · PHP Remote File Inclusion High7.5EPSS 0.3%2026-06-17CVE Database V5CVE-2025-49403 CVE-2025-49403 is a high-severity vulnerability in the AA-Team Premium Age Verification / Restriction plugin for WordPress, affecting versions up to and including 3.0.2. It allows unauthenticated attackers to perform arbitrary file downloads due to improper control of filenames used in include/require statements (CWE-98). This vulnerability could lead to exposure of sensitive files on the server. No official patch or remediation guidance is currently available from the vendor. EPSS 0.3%Vulnerability CWE-98	CVE Database V5	2026-06-17
High	8.1	EPSS 0.4%	CVE-2026-39568Mr. SEO (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2026-39568 Unauthenticated Local File Inclusion in Mr. SEO <= 2.0 versions. EPSS 0.4%Vulnerability Elated-Themes CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2026-39549Aperitif (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2026-39549 Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions. EPSS 0.4%Vulnerability Elated-Themes CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2026-39547Getaway (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2026-39547 Unauthenticated Local File Inclusion in Getaway < 1.8 versions. EPSS 0.3%Vulnerability Select-Themes CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2026-39522Solene (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2026-39522 Unauthenticated Local File Inclusion in Solene <= 3.4 versions. EPSS 0.4%Vulnerability Elated-Themes CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2026-34895Softlab Core (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2026-34895 Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions. EPSS 0.3%Vulnerability WebGeniusLab CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2026-34894Integrio Core (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2026-34894 Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions. EPSS 0.4%Vulnerability WebGeniusLab CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2026-34893Thegov Core (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2026-34893 Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions. EPSS 0.3%Vulnerability WebGeniusLab CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69178Truemag (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69178 Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions. EPSS 0.4%Vulnerability CactusThemes CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.5%	CVE-2025-69177Roneous (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.5%2026-06-16CVE Database V5CVE-2025-69177 Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions. EPSS 0.5%Vulnerability THEMELOGI CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2025-69176ITactics (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2025-69176 Unauthenticated Local File Inclusion in ITactics <= 1.0 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69168Spike (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69168 Unauthenticated Local File Inclusion in Spike <= 1.2 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69167Eros (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69167 Unauthenticated Local File Inclusion in Eros <= 1.3 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69165Choreo (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69165 Unauthenticated Local File Inclusion in Choreo <= 1.6 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69163WineShop (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69163 Unauthenticated Local File Inclusion in WineShop <= 3.17 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69162Grecko (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69162 Unauthenticated Local File Inclusion in Grecko <= 5.17 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16

Page 8 of 19