The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override th…
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.55459·Published 2023-02-13·Fixed in 1.9.1