The vulnerability in the widget options plugin is a stored XSS flaw triggered via the do_sidebar shortcode. Authenticated users with contributor access can embed malicious scripts into shortcode attributes. Once a page is accessed, that script runs in the visitor’s browser context, allowing the attacker to steal session cookies, deface content, or conduct phishing. This affects confidentiality by capturing credentials, integrity by tampering content, and availability via potential lock‑out. The issue stems from missing input validation and output encoding (CWE‑79).

The flaw is present in all releases of Marketing Fire’s Widget Options – Extended plugin up to and including version 5.2.1. WordPress sites that have this plugin installed at any of those versions and where a user has at least contributor permissions are susceptible. The plugin is distributed via the WordPress repository and can be installed in any WordPress installation. No other vendors or products are listed in the CNA data.

The CVSS base score is 6.4, indicating a moderate severity. EPSS is below 1%, implying a low probability that the flaw is actively exploited in the wild, and it is not currently in the CISA KEV list. However, any authenticated user with contributor rights can obtain the necessary access, and the attack can be performed silently through regular content editing flows. Because the script is stored and triggered on page load, attackers can achieve cross‑site scripting across all users who view the compromised page. The vulnerability is easy to exploit with no preconditions beyond legitimate contributor credentials; danger increases if many such accounts exist on a site.