Add CVE-2026-1988 WordPress Flexi Product Slider Local File Inclusion

[stranger00135]

CVE-2026-1988 — Flexi Product Slider and Grid for WooCommerce <= 1.0.5 LFI

Local File Inclusion vulnerability allowing authenticated attackers to include and execute arbitrary files on the server.

✅ Verified — True Positive

Tested against Docker WordPress environment with vulnerable plugin version. Confirmed LFI via template parameter allowing inclusion of arbitrary PHP files.

✅ Validated — No False Positive

Without plugin installed, endpoint does not exist — no false trigger.

Template validation

• Validated with vulnerable version (True Positive)
• Validated with patched version (False Positive avoided)
• All metadata complete (CVSS, CWE, CPE, Shodan/FOFA)
• 3+ matchers with condition: and

References

• NVD
• WordPress Plugin

[stranger00135]

Closing this PR — after further review I'm unable to meet all quality requirements. Thanks for your time.