Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
WooCommerce Flexi Product Slider plugin allows attackers to load malicious files
CVE-2026-1988
Summary
The Flexi Product Slider and Grid for WooCommerce plugin has a security flaw that allows hackers to load any file on the server if they have contributor-level access and can add a special shortcode to a post. This could lead to sensitive information being stolen or malicious code being executed. To fix this, update the plugin to the latest version, 1.0.6 or later.
Original title
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This ...
Original description
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.
nvd CVSS3.1
7.5
Vulnerability type
CWE-98
Improper Control of Filename for Include
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/98.html
- https://plugins.trac.wordpress.org/browser/flexi-product-slider-grid/tags/1.0.5/...
- https://plugins.trac.wordpress.org/browser/flexi-product-slider-grid/trunk/inclu...
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ffdd5446-5835-4976-b76...
Published: 14 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026