insecure include code

It was brought to my attention that your theme uses an insecure method to include CSS from other plugin files. I have seen my exploits involving malicious PHP code in CSS files, this is only a problem if those files are referenced by an include statement because the include function executes PHP code.

Example from line 1999-2000 of css.php:

if (function_exists('wp_pagenavi')) {
include (WP_PLUGIN_DIR.'/wp-pagenavi/pagenavi-css.css');

This statement could also cause a PHP error if the folder for the wp-pagenavi plugin was renamed or if another plugin uses a function called “wp_pagenavi”. To fix both the bug and the security vulnerability here you should change this code (and all the other lines like it) to something like this:

if (is_file(WP_PLUGIN_DIR.'/wp-pagenavi/pagenavi-css.css') && function_exists('wp_pagenavi')) {
echo file_get_contents(WP_PLUGIN_DIR.'/wp-pagenavi/pagenavi-css.css');

Please let me know if intend to fix this issue or if you need any help with with any of this.

Aloha, Eli