Widget Options vulnerabilities

The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.

There is a remote code execution (RCE) vulnerability in Widget Options versions <= 4.2.3 that can be exploited by an attacker.

The Widget Options – The #1 WordPress Widget & Block Control Plugin is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.