https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T02:55:06.080177+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-290078 EUVD-2026-290078 2026-10-09T02:55:06.082392+00:00 EUVD-2026-290078 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1988 fkie_cve-2026-1988 2026-10-09T02:55:06.082425+00:00

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.

 https://cve.radiocsirt.org/vuln/ghsa-w2x2-hcw6-22p4 GHSA-w2x2-hcw6-22p4 2026-10-09T02:55:06.082464+00:00

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.