Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
medium
The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ew-author, ew-archive, ew-category, ew-page, and ew-menu shortcodes in all versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it pos...
- CVSS:
- 6.4
- Affected:
- up to 3.0
- Fixed in:
- 3.0.1
- Disclosed:
- Feb 4, 2026
CVE-2026-0867 on NVD →
Essential Widgets [essential-widgets] <= 2.2.2 (unfixed)
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows Stored XSS.This issue affects Essential Widgets: from n/a through <= 2.2.2.
- Affected:
- up to 2.2.2
- Fix:
- No patched version reported
- Disclosed:
- Dec 9, 2025
CVE-2025-67543 on NVD →
Essential Widgets <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Essential Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in page...
- CVSS:
- 6.4
- Affected:
- up to 2.2.2
- Fixed in:
- 2.3
- Disclosed:
- Nov 26, 2025
CVE-2025-67543 on NVD →
Essential Widgets [essential-widgets] < 1.9 (closed)
unknown
[en] Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin be...
- Affected:
- up to 1.9
- Fixed in:
- 1.9
- Disclosed:
- Oct 18, 2021
CVE-2021-24752 on NVD →
CatchThemes Plugins (Various Versions) - Missing Authorization
medium
Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before...
- CVSS:
- 5.4
- Affected:
- up to 1.9
- Fixed in:
- 1.9
- Disclosed:
- Sep 20, 2021
CVE-2021-24752 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database