CVE-2025-14502

🗓️ 14 Jan 2026 05:28:13Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

Unauthenticated local file inclusion in News and Blog Designer Bundle up to version 1.1 via the template parameter.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-14502	14 Jan 202607:03	–	circl
CNNVD	WordPress plugin News and Blog Designer Bundle 安全漏洞	14 Jan 202600:00	–	cnnvd
Cvelist	CVE-2025-14502 News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion	14 Jan 202605:28	–	cvelist
GithubExploit	Exploit for CVE-2025-14502	15 Jan 202609:00	–	githubexploit
EUVD	EUVD-2026-2542	14 Jan 202605:28	–	euvd
NVD	CVE-2025-14502	14 Jan 202606:15	–	nvd
Patchstack	WordPress News and Blog Designer Bundle plugin <= 1.1 - Unauthenticated Local File Inclusion vulnerability	14 Jan 202612:42	–	patchstack
Positive Technologies	PT-2026-2814	14 Jan 202600:00	–	ptsecurity
RedhatCVE	CVE-2025-14502	15 Jan 202606:22	–	redhatcve
The Hacker News	⚡ Weekly Recap: Fortinet Exploits, RedLine Clipjack, NTLM Crack, Copilot Attack & More	19 Jan 202613:17	–	thn

Vulners

Node

vaghasia3 news_and_blog_designer_bundleRange≤1.1wordpress

[
  {
    "vendor": "vaghasia3",
    "product": "News and Blog Designer Bundle",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e02683dc-0771-4bd5-bba3-2b5423da1c80
plugins	www.plugins.trac.wordpress.org/browser/news-and-blog-designer-bundle/trunk/includes/class-nbdb-ajax.php

Parameter	Position	Path	Description	CWE
shrt_param[template]	request body	/wp-admin/admin-ajax.php	Local File Inclusion via unsafely extracted template parameter leading to inclusion of arbitrary PHP files.	CWE-98

17 Jun 2026 08:36Current

7High risk

Vulners AI Score7

CVSS 3.19.8

EPSS0.01336

SSVC

CWE-98