Known vulnerabilities in the Widgets plugin

15 security advisories have been published for the Widgets plugin. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.

Widgets - Cross-Site Scripting (XSS) (CVE-2026-15145) MEDIUM 2026-07-21
Widgets - Cross-Site Scripting (XSS) (CVE-2026-15156) MEDIUM 2026-07-21
Widgets - Security Vulnerability (CVE-2026-15155) HIGH 2026-07-11
Widgets - Cross-Site Scripting (XSS) (CVE-2026-12141) MEDIUM 2026-07-11
Widgets - Cross-Site Scripting (XSS) (CVE-2026-6459) MEDIUM 2026-07-08
Widgets - Information Disclosure (CVE-2026-7665) MEDIUM 2026-06-06
Widgets - Broken Access Control (CVE-2026-3896) MEDIUM 2026-05-27
Widgets - Privilege Escalation (CVE-2026-5193) MEDIUM 2026-05-14
Widgets - Cross-Site Scripting (XSS) (CVE-2026-4790) MEDIUM 2026-05-02
Widgets - Cross-Site Scripting (XSS) (CVE-2026-1512) MEDIUM 2026-02-14
Widgets - Broken Access Control (CVE-2026-2295) MEDIUM 2026-02-11
Widgets - Broken Access Control (CVE-2025-14155) MEDIUM 2025-12-23
Widgets - Cross-Site Scripting (XSS) (CVE-2025-13977) MEDIUM 2025-12-17
Widgets - Cross-Site Scripting (XSS) (CVE-2025-8780) MEDIUM 2025-12-13
Widgets - Cross-Site Scripting (XSS) (CVE-2025-8451) MEDIUM 2025-08-15

Browse the full threat database

WordPress security that blocks attacks before they land.

sales@hackhalt.com

© Hack Halt Inc. All rights reserved.