Astra Widgets Vulnerabilities

The Astra Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that w...

CVSS:

4.4

Affected:

up to 1.2.16

Fixed in:

1.2.17

Disclosed:

Dec 28, 2025

CVE-2025-68497 on NVD →

The Astra Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t...

CVSS:

6.4

Affected:

up to 1.2.15

Fixed in:

1.2.16

Disclosed:

Jan 3, 2025

CVE-2024-56274 on NVD →

The Astra Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages t...

CVSS:

6.4

Affected:

up to 1.2.14

Fixed in:

1.2.15

Disclosed:

Oct 24, 2024

CVE-2024-50439 on NVD →