High severity8.1NVD Advisory· Published Dec 13, 2025· Updated Apr 15, 2026
CVE-2025-14475
CVE-2025-14475
Description
The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the extensive_vc_get_module_template_part function. This is due to insufficient path normalization and validation of the user-supplied shortcode_name parameter in the extensive_vc_init_shortcode_pagination AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files via the shortcode_name parameter.
Affected products
1- Range: <=1.9.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/lib/helpers-functions.phpnvd
- plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.phpnvd
- plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.phpnvd
- plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/lib/helpers-functions.phpnvd
- plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.phpnvd
- plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.phpnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/49711408-5d04-4fdd-a6c4-b224959ba1bcnvd
News mentions
0No linked articles in our index yet.