The vulnerability is a stored cross‑site scripting flaw in the Widget Options plugin due to insufficient input sanitization and output escaping. Authenticated users with Contributor level or higher can inject arbitrary JavaScript into pages, which executes whenever a visitor loads the page. This can lead to session hijacking, defacement, and malicious redirection, compromising confidentiality, integrity, and availability of site data for all users. The weakness is identified as CWE‑79.

WordPress sites that have installed the Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin, version 4.1.2 or earlier. The vendor/product is marketingfire:Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets. No other vendors/products are impacted according to the CNA data. The vulnerability affects all WordPress installations that import or use widget settings from the affected plugin.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% indicates a very low probability of widespread exploitation at this time. The weakness is not listed in the CISA KEV catalog. Exploitation requires authenticated access at Contributor level or higher, which most sites grant to registered authors or administrators. The attack vector can be through the plugin’s admin interface or any page where widget settings are stored and rendered. Because the flaw is stored, the malicious payload persists until the content is removed or the plugin is updated.