// classes/class-templates.php (around line 19)

public static function include_template( $template_name, $args = array() ) {
    // Allow 3rd party plugin filter template args from their plugin.
    $args = apply_filters( 'vpf_include_template_args', $args, $template_name );

    if ( ! empty( $args ) && is_array( $args ) ) {
        // phpcs:ignore WordPress.PHP.DontExtract.extract_extract
        extract( $args );
    }

    // template in theme folder.
    $template = locate_template( array( '/visual-portfolio/' . $template_name . '.php' ) );

    // pro plugin template.
    if ( ! $template && visual_portfolio()->pro_plugin_path && file_exists( visual_portfolio()->pro_plugin_path . 'templates/' . $template_name . '.php' ) ) {
        $template = visual_portfolio()->pro_plugin_path . 'templates/' . $template_name . '.php';
    }

    // default template.
    if ( ! $template ) {
        $template = visual_portfolio()->plugin_path . 'templates/' . $template_name . '.php';
    }

    // Allow 3rd party plugin filter template file from their plugin.
    $template = apply_filters( 'vpf_include_template', $template, $template_name, $args );

    if ( file_exists( $template ) ) {
        include $template;
    }
}

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.1/classes/class-security.php /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.2/classes/class-security.php
--- /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.1/classes/class-security.php	2025-06-26 08:46:04.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.2/classes/class-security.php	2026-02-18 07:58:28.000000000 +0000
@@ -249,6 +249,55 @@
 	}
 
 	/**
+	 * Sanitize icons selector attribute.
+	 *
+	 * Icons selector options are usually provided as an indexed array where each
+	 * option contains a `value` key, unlike regular select controls that may use
+	 * associative options by key.
+	 *
+	 * @param int|float|string $attribute - Unclear Selector Attribute.
+	 * @param array            $control - Array of control parameters.
+	 * @return int|float|string
+	 */
+	public static function sanitize_icons_selector( $attribute, $control ) {
+		$valid_options = array();
+
+		if ( isset( $control['options'] ) && is_array( $control['options'] ) ) {
+			foreach ( $control['options'] as $option_key => $option_data ) {
+				if ( is_array( $option_data ) && isset( $option_data['value'] ) ) {
+					$valid_options[] = (string) $option_data['value'];
+				} else {
+					$valid_options[] = (string) $option_key;
+				}
+			}
+		}
+
+		$attribute_string = is_bool( $attribute ) ? ( $attribute ? 'true' : 'false' ) : (string) $attribute;
+
+		// Reject path traversal sequences regardless of control options state.
+		if ( validate_file( $attribute_string ) !== 0 ) {
+			$attribute = self::reset_control_attribute_to_default( $attribute, $control );
+		}
+
+		// Apply strict allowlist only when options are available.
+		if ( ! empty( $valid_options ) && ! in_array( $attribute_string, $valid_options, true ) ) {
+			$attribute = self::reset_control_attribute_to_default( $attribute, $control );
+		}
+
+		if ( is_numeric( $attribute ) ) {
+			if ( false === strpos( $attribute, '.' ) ) {
+				$attribute = intval( $attribute );
+			} else {
+				$attribute = (float) $attribute;
+			}
+		} else {
+			$attribute = sanitize_text_field( wp_unslash( $attribute ) );
+		}
+
+		return $attribute;
+	}
+
+	/**
 	 * Reset the value of the control attribute to the default value.
 	 * Also check the attribute for a boolean value,
 	 * And if the default value contains a string like 'true' or 'false',
@@ -473,6 +522,9 @@
 							$attributes[ $key ] = self::sanitize_hidden( $attribute );
 							break;
 						case 'icons_selector':
+							// Layer 2: Validate against allowed options (same as 'select' type).
+							$attributes[ $key ] = self::sanitize_icons_selector( $attributes[ $key ], $controls[ $key ] );
+							break;
 						case 'text':
 						case 'radio':
 						case 'align':
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.1/classes/class-templates.php /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.2/classes/class-templates.php
--- /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.1/classes/class-templates.php	2023-11-25 22:33:20.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/visual-portfolio/3.5.2/classes/class-templates.php	2026-02-18 07:58:28.000000000 +0000
@@ -16,6 +16,11 @@
 	 * @param array  $args args for template.
 	 */
 	public static function include_template( $template_name, $args = array() ) {
+		// Layer 1: Reject template names containing path traversal sequences.
+		if ( validate_file( $template_name ) !== 0 ) {
+			return;
+		}
+
 		// Allow 3rd party plugin filter template args from their plugin.
 		$args = apply_filters( 'vpf_include_template_args', $args, $template_name );
 
@@ -41,17 +46,84 @@
 		$template = apply_filters( 'vpf_include_template', $template, $template_name, $args );
 
 		if ( file_exists( $template ) ) {
-			include $template;
+			// Layer 3: Verify the resolved path is within allowed directories.
+			$real_path = realpath( $template );
+
+			if ( $real_path && self::is_allowed_template_path( $real_path ) ) {
+				include $template;
+			}
 		}
 	}
 
 	/**
+	 * Check if a resolved file path is within allowed template directories.
+	 *
+	 * Layer 3: Prevents inclusion of files outside expected template directories,
+	 * even if path traversal bypasses other checks.
+	 *
+	 * @param string $real_path The resolved (realpath) file path to check.
+	 * @return bool True if the path is within an allowed directory.
+	 */
+	public static function is_allowed_template_path( $real_path ) {
+		$normalized_real_path = wp_normalize_path( $real_path );
+
+		if ( ! $normalized_real_path ) {
+			return false;
+		}
+
+		$allowed_dirs = array(
+			visual_portfolio()->plugin_path . 'templates/',
+			get_stylesheet_directory() . '/visual-portfolio/',
+			get_template_directory() . '/visual-portfolio/',
+		);
+
+		if ( visual_portfolio()->pro_plugin_path ) {
+			$allowed_dirs[] = visual_portfolio()->pro_plugin_path . 'templates/';
+		}
+
+		/**
+		 * Filters the list of allowed template directories.
+		 *
+		 * This is used by the Layer 3 realpath() inclusion guard.
+		 * Add your plugin directory here if you return a custom absolute template
+		 * path via the `vpf_include_template` filter.
+		 *
+		 * @since 3.5.2
+		 *
+		 * @param array  $allowed_dirs Allowed directories (absolute paths).
+		 * @param string $real_path    Resolved real path to the included template.
+		 */
+		$allowed_dirs = (array) apply_filters( 'vpf_allowed_template_dirs', $allowed_dirs, $real_path );
+
+		// Resolve all allowed directories to their real paths.
+		$allowed_dirs = array_filter( array_map( 'realpath', $allowed_dirs ) );
+
+		foreach ( $allowed_dirs as $dir ) {
+			$normalized_dir = trailingslashit( wp_normalize_path( $dir ) );
+
+			if ( strpos( $normalized_real_path, $normalized_dir ) === 0 ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
+	/**
 	 * Find css template file
 	 *
 	 * @param string $template_name file name.
 	 * @return string
 	 */
 	public static function find_template_styles( $template_name ) {
+		// Layer 1: Reject template names containing path traversal sequences.
+		if ( validate_file( $template_name ) !== 0 ) {
+			return array(
+				'path'    => '',
+				'version' => '',
+			);
+		}
+
 		$template         = '';
 		$template_version = '';