Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

Widget Options

Source -

CNA

CNA CVEs -

6

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

0
Related CVEsRelated VendorsRelated AssignersReports
6Vulnerabilities found
CVE-2026-54823
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-9.9||CRITICAL
EPSS-0.56% / 43.24%
||
7 Day CHG+0.13%
Published-25 Jun, 2026 | 13:12
Updated-25 Jun, 2026 | 16:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Widget Options plugin <= 4.2.3 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

Action-Not Available
Vendor-MarketingFire
Product-Widget Options
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2024-35690
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.5||MEDIUM
EPSS-0.29% / 21.54%
||
7 Day CHG~0.00%
Published-17 Jun, 2026 | 12:05
Updated-17 Jun, 2026 | 14:45
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability

Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1.

Action-Not Available
Vendor-MarketingFire
Product-Widget Options
CWE ID-CWE-201
Insertion of Sensitive Information Into Sent Data
CVE-2026-27984
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-9||CRITICAL
EPSS-0.27% / 19.01%
||
7 Day CHG~0.00%
Published-05 Mar, 2026 | 05:54
Updated-28 Apr, 2026 | 16:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Widget Options plugin <= 4.1.3 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Marketing Fire Widget Options widget-options allows Code Injection.This issue affects Widget Options: from n/a through <= 4.1.3.

Action-Not Available
Vendor-Marketing Fire
Product-Widget Options
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2025-22630
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-9.9||CRITICAL
EPSS-1.12% / 62.68%
||
7 Day CHG~0.00%
Published-14 Feb, 2025 | 07:10
Updated-28 Apr, 2026 | 16:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Widget Options Plugin <= 4.1.0 - Arbitrary Code Execution vulnerability

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Marketing Fire Widget Options widget-options allows OS Command Injection.This issue affects Widget Options: from n/a through <= 4.1.0.

Action-Not Available
Vendor-Marketing Fire
Product-Widget Options
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-22722
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.23% / 14.23%
||
7 Day CHG~0.00%
Published-21 Jan, 2025 | 17:21
Updated-28 Apr, 2026 | 16:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Widget Options plugin <= 4.0.8 - Broken Access Control to Notice Dimissal vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.8.

Action-Not Available
Vendor-Marketing Fire
Product-Widget Options
CWE ID-CWE-862
Missing Authorization
CVE-2024-56219
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-4.3||MEDIUM
EPSS-0.34% / 26.50%
||
7 Day CHG+0.01%
Published-31 Dec, 2024 | 10:22
Updated-28 Apr, 2026 | 16:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Marketing Fire Widget Options widget-options allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widget Options: from n/a through <= 4.0.6.1.

Action-Not Available
Vendor-Marketing Fire
Product-Widget Options
CWE ID-CWE-862
Missing Authorization