Skip to content
Noroxi

SiteOrigin Widgets Bundle

so-widgets-bundle · plugin

Known security vulnerabilities for SiteOrigin Widgets Bundle. Find out in seconds which version runs on your site with WP Lens.

10 known vulnerabilities

latest Oct 2, 2026

Listed on wordpress.org · latest 1.75.0 · last updated Oct 2, 2026 · 400K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-54268login required≤ 1.64.0

    WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability

    High 8.8

  • CVE-2026-92174contributor+≤ 1.73.2

    SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter

    High 7.5

  • CVE-2026-2127subscriber+≤ 1.70.4

    SiteOrigin Widgets Bundle <= 1.70.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution

    Medium 5.4

  • CVE-2024-5901contributor+≤ 1.62.2

    SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget

    Medium 5.4

  • CVE-2024-5090contributor+≤ 1.61.1

    SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget

    Medium 5.4

  • CVE-2024-4362contributor+≤ 1.60.0

    SiteOrigin Widgets Bundle <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode

    Medium 5.4

  • CVE-2024-1723contributor+≤ 1.58.7

    SiteOrigin Widgets Bundle <= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-1070contributor+≤ 1.58.2

    SiteOrigin Widgets Bundle <= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-1058contributor+≤ 1.58.3

    SiteOrigin Widgets Bundle <= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2024-0961contributor+≤ 1.58.1

    SiteOrigin Widgets Bundle <= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 5.4

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory