Read this article carefully if you are looking to secure your website especially if you're using WordPress, Joomla, or any other CMS .

Local File Inclusion

Local File Inclusion (LFI) is similar to a Remote File Inclusion vulnerability except instead of including remote files, only local files i.e. files on the current server can be included. The vulnerability is also due to the use of user-supplied input without proper validation. 

attacker can use persistent xss , and for non persistent xss attacker can use shorten url ,

but that need to stick the victim in a website for a while .