Popping Sidebars And Widgets Light Vulnerabilities

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Stored XSS.This issue affects Popping Sidebars and Widgets Light: from n/a through <= 1.27.

Affected:

up to 1.27

Fix:

No patched version reported

Disclosed:

Dec 30, 2025

CVE-2025-69007 on NVD →

The Popping Sidebars and Widgets Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.27 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary w...

CVSS:

4.4

Affected:

up to 1.27

Fix:

No patched version reported

Disclosed:

Dec 26, 2025

CVE-2025-69007 on NVD →

The Popping Sidebars and Widgets Light plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.27. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can...

CVSS:

4.3

Affected:

up to 1.27

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58853 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Popping Sidebars and Widgets Light allows Reflected XSS. This issue affects Popping Sidebars and Widgets Light: from n/a through 1.27.

Affected:

up to 1.27

Fix:

No patched version reported

Disclosed:

Sep 5, 2025

CVE-2025-58853 on NVD →