CVE-2025-10580

MediumCVSS 6.4

Published: 25/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Widget Options – The #1 WordPress Widget & Block Control Plugin is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.

Risk Assessment

Injected scripts can execute in users' browsers, potentially leading to data theft, session hijacking, or phishing attacks.

Recommendation

Update the Widget Options plugin to the latest patched version. Restrict account privileges and monitor content for malicious scripts.

Other vulnerabilities in Widget Options

CVE-2026-54823Critical
There is a remote code execution (RCE) vulnerability in Widget Options versions <= 4.2.3 that can be exploited by an attacker.

Original NVD description (English source)

The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS