Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter
high
The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insuf...
- CVSS:
- 8.8
- Affected:
- up to 1.52
- Fix:
- No patched version reported
- Disclosed:
- Jul 7, 2026
CVE-2026-14158 on NVD →
Widget Logic Visual [widget-logic-visual] <= 1.52 (unfixed)
unknown
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalbounty Widget Logic Visual widget-logic-visual allows Reflected XSS.This issue affects Widget Logic Visual: from n/a through <= 1.52.
- Affected:
- up to 1.52
- Fix:
- No patched version reported
- Disclosed:
- Feb 20, 2026
CVE-2025-68842 on NVD →
Widget Logic Visual <= 1.52 - Reflected Cross-Site Scripting
medium
The Widget Logic Visual plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.52 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfu...
- CVSS:
- 6.1
- Affected:
- up to 1.52
- Fix:
- No patched version reported
- Disclosed:
- Jan 27, 2026
CVE-2025-68842 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database