{
 "id": "WPSEC-2026-1714",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1714/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1714/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1714/index.md",
 "title": "Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Custom ID and Class Attributes",
 "description": "The Widget Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom ID and class attributes the plugin writes onto rendered blocks in all versions up to, and including, 4.2.5. This is due to the plugin inserting the ID and classes with regular-expression substring replacement of 'id=\"' and 'class=\"' on the block markup. That text can match inside another attribute's value and break the tag's quoting, which turns harmless attribute text into live event handlers. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
 "plugin": {
  "slug": "widget-options",
  "name": "Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets",
  "full_name": "Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets",
  "wordpress_org": "https://wordpress.org/plugins/widget-options/",
  "advisories_url": "https://wpsec.com/vuln/plugin/widget-options/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/widget-options"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.6",
 "remediation": "Update to 4.2.6 or later.",
 "fix_released": "2026-10-26T10:19:28+00:00",
 "published": "2026-10-27T10:49:10+00:00",
 "updated": "2026-10-26T13:20:58.190617+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1714/",
  "https://plugins.svn.wordpress.org/widget-options/tags/4.2.6/",
  "https://wordpress.org/plugins/widget-options/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/widget-options",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "Medium",
  "as_of": "2026-10-27"
 }
}