Plugin icon

SiteOrigin Widgets Bundle

so-widgets-bundle

Vulnerabilities:

11

Last Updated:

February 13, 2026

Active Installs:

400000

Published
Title
Fixed in
CVSS
Published
2026-02-17
Title
SiteOrigin Widgets Bundle < 1.71.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
Fixed in
Fixed in 1.71.0
CVSS
5.4 (medium)
Published
2025-06-24
Title
SiteOrigin Widgets Bundle < 1.69.0 - Contributor+ Stored XSS via `data-url` DOM Element Attribute
Fixed in
Fixed in 1.69.0
CVSS
5.9 (medium)
Published
2024-12-10
Title
SiteOrigin Widgets Bundle < 1.64.1 - Missing Authorization
Fixed in
Fixed in 1.64.1
CVSS
2.7 (low)
Published
2024-07-30
Title
SiteOrigin Widgets Bundle < 1.62.3 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget
Fixed in
Fixed in 1.62.3
CVSS
6.4 (medium)
Published
2024-06-10
Title
SiteOrigin Widgets Bundle < 1.62.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget
Fixed in
Fixed in 1.62.0
CVSS
6.4 (medium)
Published
2024-05-21
Title
SiteOrigin Widgets Bundle < 1.61.0 - Contributor+ Stored XSS via siteorigin_widget Shortcode
Fixed in
Fixed in 1.61.0
CVSS
5.9 (medium)
Published
2024-03-04
Title
SiteOrigin Widgets Bundle < 1.58.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.58.8
CVSS
6.4 (medium)
Published
2024-02-12
Title
SiteOrigin Widgets Bundle < 1.58.3 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.58.3
CVSS
6.4 (medium)
Published
2024-02-12
Title
SiteOrigin Widgets Bundle < 1.58.4 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.58.4
CVSS
6.4 (medium)
Published
2024-01-29
Title
SiteOrigin Widgets Bundle < 1.58.2 - Contributor+ Stored XSS
Fixed in
Fixed in 1.58.2
CVSS
5.9 (medium)
Published
2023-11-27
Title
so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion
Fixed in
Fixed in 1.51.0
CVSS
5.5 (medium)