# Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Custom ID and Class Attributes

- **ID:** WPSEC-2026-1714
- **Plugin:** Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets (`widget-options`), https://wordpress.org/plugins/widget-options/
- **Affected versions:** all versions before 4.2.6
- **Fixed in:** 4.2.6 (Update to 4.2.6 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions Medium (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/widget-options
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1714/

## Description

The Widget Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom ID and class attributes the plugin writes onto rendered blocks in all versions up to, and including, 4.2.5. This is due to the plugin inserting the ID and classes with regular-expression substring replacement of 'id="' and 'class="' on the block markup. That text can match inside another attribute's value and break the tag's quoting, which turns harmless attribute text into live event handlers. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-1714/
- https://plugins.svn.wordpress.org/widget-options/tags/4.2.6/
- https://wordpress.org/plugins/widget-options/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1714/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.