The WP Widget Changer plugin is affected by a reflected cross‑site scripting flaw that occurs when data from the $_SERVER['PHP_SELF'] variable is used without proper sanitization or escaping. This weakness allows an attacker to embed malicious JavaScript into a page that a legitimate user is directed to. The result is that, when the victim opens the crafted link, the script runs in the context of the infected WordPress site, potentially leading to theft of user credentials, session hijacking, or defacement of the site. The vulnerability is identified as CWE‑79.

WordPress sites that have the WP Widget Changer plugin installed with any version from the first release up to and including 1.2.5. The plugin was developed by Damienoh and is distributed through the WordPress plugin repository.

The CVSS base score of 6.1 indicates a moderate severity vulnerability. The EPSS score of less than 1 % suggests that exploitation is currently unlikely, but the problem is still exploitable by an unauthenticated actor who can convince a user to click a malicious link. Because the flaw relies on client‑side execution of injected scripts, the impact is confined to users who visit the compromised page; it does not require prior authentication or administrative access. The vulnerability is not listed in the CISA KEV catalog, but it remains a legitimate risk for any site running vulnerable plugin versions.