CVE-2026-1988

The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.

• CWE-98

• https://cwe.mitre.org/data/definitions/22.html
• https://cwe.mitre.org/data/definitions/98.html
• https://plugins.trac.wordpress.org/browser/flexi-product-slider-grid/tags/1.0.5/includes/class-flexipsg-shortcode.php#L82
• https://plugins.trac.wordpress.org/browser/flexi-product-slider-grid/trunk/includes/class-flexipsg-shortcode.php#L82
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdd5446-5835-4976-b764-9b5c75251438?source=cve

Published

Feb 14, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19872HTML::FormHandler versions before 0.410000 for Perl allow cr…6.1
• CVE-2026-19873HTML::FormFu versions through 2.08 for Perl allow resource e…7.5
• CVE-2026-19874A heap-based buffer overflow vulnerability exists in Konami'…9.1
• CVE-2026-19875IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote a…7.5
• CVE-2026-19878IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…6.5
• CVE-2026-19879A flaw was found in Undertow, an HTTP server, within its HTT…5.3
• CVE-2026-19880Path-traversal vulnerability in QOS.CH Sarl Logback-classic …6.3
• CVE-2026-19883The WPeMatico RSS Feed Fetcher plugin for WordPress is vulne…8.8
• CVE-2026-19884In Eclipse Theia versions up to and including 1.69.0, openin…8.4
• CVE-2026-19885OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Writ…7.8
• CVE-2026-19886OriginLab Origin Viewer OGM File Parsing Memory Corruption R…7.8
• CVE-2026-19887The Welcart e-Commerce plugin for WordPress is vulnerable to…8.8