CVE-2026-54823
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
There is a remote code execution (RCE) vulnerability in Widget Options versions <= 4.2.3 that can be exploited by an attacker.
Risk Assessment
Exploitation of this vulnerability could lead to unauthorized control over the system, posing a serious security threat to the organization.
Recommendation
It is recommended to update to the latest version of Widget Options to mitigate this vulnerability.
Other vulnerabilities in Widget Options
See all- CVE-2026-116852Critical
The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.
- CVE-2025-10580Medium
The Widget Options – The #1 WordPress Widget & Block Control Plugin is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2. Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts.
Original NVD description (English source)
Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS