CVE-2025-11704

The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menu' attribute of the `elegance-menu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

• CWE-98

• https://plugins.trac.wordpress.org/browser/elegance-menu/trunk/public/class-elegance-menu-public.php#L222
• https://plugins.trac.wordpress.org/changeset/3409312/
• https://wordpress.org/plugins/elegance-menu
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9cecce4d-5d4a-4286-97dc-88a379e21b60?source=cve

Published

Nov 4, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11699nopCommerce v4.70 and prior, and version 4.80.3, does not in…7.1
• CVE-2025-1170A vulnerability classified as problematic has been found in …5.4
• CVE-2025-11700N-central versions < 2025.4 are vulnerable to multiple XML E…7.5
• CVE-2025-11701The Zip Attachments plugin for WordPress is vulnerable to un…5.3
• CVE-2025-11702GitLab has remediated an issue in EE affecting all versions …8.8
• CVE-2025-11703The WP Go Maps (formerly WP Google Maps) plugin for WordPres…5.3
• CVE-2025-11705The Anti-Malware Security and Brute-Force Firewall plugin fo…6.5
• CVE-2025-11706The Aruba HiSpeed Cache plugin for WordPress is vulnerable t…6.1
• CVE-2025-11707The Login Lockdown & Protection plugin for WordPress is vuln…5.3
• CVE-2025-11708Use-after-free in MediaTrackGraphImpl::GetInstance(). This v…9.8
• CVE-2025-11709A compromised web process was able to trigger out of bounds …9.8
• CVE-2025-1171A vulnerability classified as problematic was found in code-…6.1