Skip to content
Noroxi

Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets

widget-options · plugin

Known security vulnerabilities for Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets. Find out in seconds which version runs on your site with WP Lens.

9 known vulnerabilities

4 critical · 1 with public exploit code · latest Jun 25, 2026

Listed on wordpress.org · latest 4.2.5 · last updated Sep 11, 2026 · 100K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-22630login required≤ 4.1.0

    WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerability

    Critical 9.9

  • CVE-2026-54823contributor+≤ 4.2.3

    WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability

    Critical 9.9

  • CVE-2024-8672contributor+≤ 4.0.7

    Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

    Critical 9.9

  • CVE-2026-27984login required≤ 4.1.3

    WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability

    Critical 9.0

  • CVE-2026-2052contributor+≤ 5.3.2

    Widget Options <= 4.2.2 - Authenticated (Contributor+) Remote Code Execution via Display Logic

    High 8.8

  • CVE-2024-35690subscriber+≤ 4.0.1

    WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability

    Medium 6.5

  • CVE-2025-10580contributor+≤ 4.1.2

    Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2025-22722login required≤ 4.0.8

    WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

    Medium 4.3

  • CVE-2024-56219login required≤ 4.0.6.1

    WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory