Include Me Vulnerabilities

The Include Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages tha...

CVSS:

4.4

Affected:

up to 1.3.2

Fixed in:

1.3.3

Disclosed:

Sep 9, 2025

CVE-2025-58983 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me allows Stored XSS. This issue affects Include Me: from n/a through 1.3.2.

Affected:

up to 1.3.3

Fixed in:

1.3.3

Disclosed:

Sep 9, 2025

CVE-2025-58983 on NVD →

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure

CVSS:

8.8

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Jan 2, 2022

CVE-2021-24453 on NVD →

[en] The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Jul 19, 2021

CVE-2021-24453 on NVD →