Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,525 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Ultimate Addons for WPBakeryWPBakery Page Builder Addons by LivemeshWPBakery Visual ComposerWPBakery Page BuilderTheGem Theme Elements (for WPBakery)Web and WooCommerce Addons for WPBakery BuilderExtensive VC Addons for WPBakery page builderPricing Tables For WPBakery Page Builder (formerly Visual Composer)
Plugin · extensive-vc-addon
Extensive VC Addons for WPBakery page builder
3 known vulnerabilities on record. Add your version above to see which ones affect you.
Is Extensive VC Addons for WPBakery page builder safe? The full page →
Feb 20, 2026Extensive VC Addons for WPBakery page builder: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-60087 · affects up to 1.9.1 · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nenad Obradovic Extensive VC Addons for WPBakery page builder extensive-vc-addon allows PHP Local File Inclusion.This issue affects Extensive VC Addons for WPBakery page builder: from n/a through <= 1.9.1.
Dec 13, 2025Extensive VC Addons for WPBakery page builder: Local File InclusionCVE-2025-14475 · affects up to 1.9.1 · reported by WordfenceHigh 8.1
The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the `extensive_vc_get_module_template_part` function. This is due to insufficient path normalization and validation of the user-supplied `shortcode_name` parameter in the `extensive_vc_init_shortcode_pagination` AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files via the `shortcode_name` parameter.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2023Extensive VC Addons for WPBakery page builder: Does not validate a parameter passed to the php extract functionCVE-2023-0159 · fixed in 1.9.1 · reported by WPScanHigh 7.5
The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.