{"id":"CVE-2025-24782","aliases":["EUVD-2025-3945","GHSA-cmcq-wxqx-v9r5"],"status":"published","title":"WordPress Post Grid, Slider \u0026 Carousel Ultimate – with Shortcode, Gutenberg Block \u0026 Elementor Widget plugin \u003c= 1.6.10 - Local File Inclusion vulnerability","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider \u0026 Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider \u0026 Carousel Ultimate: from n/a through \u003c= 1.6.10.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00474,"percentile":0.41462,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-98"],"published":"2025-01-27T14:22:19Z","modified":"2026-06-17T08:59:35Z","products":[{"vendor":"wpwax","product":"post grid, slider \u0026 carousel ultimate"},{"vendor":"wpwax","product":"post_grid\\,_slider_\\\u0026_carousel_ultimate"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/post-grid-carousel-ultimate/vulnerability/wordpress-post-grid-slider-carousel-ultimate-with-shortcode-gutenberg-block-elementor-widget-plugin-1-6-10-local-file-inclusion-vulnerability?_s_id=cve","tags":["vdb-entry","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24782"},{"url":"https://patchstack.com/database/wordpress/plugin/post-grid-carousel-ultimate/vulnerability/wordpress-post-grid-slider-carousel-ultimate-with-shortcode-gutenberg-block-elementor-widget-plugin-1-6-10-local-file-inclusion-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-cmcq-wxqx-v9r5"}],"sources":{"cve":[{"id":"CVE-2025-24782","title":"WordPress Post Grid, Slider \u0026 Carousel Ultimate – with Shortcode, Gutenberg Block \u0026 Elementor Widget plugin \u003c= 1.6.10 - Local File Inclusion vulnerability","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider \u0026 Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider \u0026 Carousel Ultimate: from n/a through \u003c= 1.6.10.","status":"published","published":"2025-01-27T14:22:19.82Z","modified":"2026-05-11T23:21:06.943Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:32:43.770144Z"}],"euvd":[{"id":"EUVD-2025-3945","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider \u0026 Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider \u0026 Carousel Ultimate: from n/a through \u003c= 1.6.10.","status":"published","published":"2025-01-27T14:22:19Z","modified":"2026-05-11T23:21:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:41.326864Z"}],"ghsa":[{"id":"GHSA-cmcq-wxqx-v9r5","title":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File...","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider \u0026 Carousel Ultimate allows PHP Local File Inclusion. This issue affects Post Grid, Slider \u0026 Carousel Ultimate: from n/a through 1.6.10.","status":"published","published":"2025-01-27T15:30:58Z","modified":"2025-01-27T15:31:05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:59:41.175336Z"}],"nvd":[{"id":"CVE-2025-24782","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider \u0026 Carousel Ultimate post-grid-carousel-ultimate allows PHP Local File Inclusion.This issue affects Post Grid, Slider \u0026 Carousel Ultimate: from n/a through \u003c= 1.6.10.","status":"published","published":"2025-01-27T15:15:17.45Z","modified":"2026-06-17T08:59:35.94Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:10:49.841519Z"}]}}