¿Es seguro Widget Options?

Qué hace este plugin

• Slug: widget-options
• 100000+ instalaciones activas

blocksblocks visibility rulesclassic widgetsgutenberg widgetswidget control

Estado de mantenimiento

• Última versión conocida: 4.2.5
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

10 CVEs conocidos registrados para Widget Options. Reportadas entre 2024 y 2026.

CVE-2026-54823

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-2052

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.2 via the Display Logic feature. This is due to the plugin using eval() on user-supplied Display Logic expressions with an insufficient blocklist/allowlist that can be bypassed using array_map with string concatenation, combined with a lack of authorization enforcement on the extended_widget_opts_block attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server. The vulnerability was partially patched in version 4.2.0.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-27984

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-10580

The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple functions in all versions up to, and including, 4.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-22630

The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.1.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-22722

The Widget Options plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the widgetopts_ajax_hide_rating() function in versions up to, and including, 4.0.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to dismiss a ratings notice.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-56219

The Widget Options plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the widgetopts_save_widget_editor_cache() function in versions up to, and including, 4.0.6.1. This makes it possible for authenticated attackers, with contributor-level access and above, to save caches.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-8672

The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.7 via the display logic functionality that extends several page builders. This is due to the plugin allowing users to supply input that will be passed through eval() without any filtering or capability checks. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. Special note: We suggested the vendor implement an allowlist of functions and limit the ability to execute commands to just administrators, however, they did not take our advice. We are considering this patched, however, we believe it could still be further hardened and there may be residual risk with how the issue is currently patched.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 2 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-35690	Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets [widget-options] < 4.0.2	Inserción de información sensible en los datos enviados	Media 6,5	< 4.0.2	4.0.2	2024-06-06	✓ corregido en la última versión
CVE-2024-35691	Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets [widget-options] < 4.0.2	Exposición de información sensible a un actor no autorizado	Media 6,5	< 4.0.2	4.0.2	2024-06-06	✓ corregido en la última versión

CVE-2024-35690

<p>WordPress Widget Options Plugin <= 4.0.1 is vulnerable to Sensitive Data Exposure</p><p>Software: Widget Options</p><p>Link: https://wordpress.org/plugins/widget-options/#developers</p><p>Affected Version <= 4.0.1</p><p>Fixed in version 4.0.2 </p>

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-35691

The Widget Options - Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to 5.1.3 (exclusive) for Widget Options - Extended and all versions up to, and including, 4.0.1 for Widget Options. This makes it possible for unauthenticated attackers to extract sensitive data including private/draft posts and user meta. CVE-2024-35690 was also assigned to this issue (specifically for the free version)

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Widget Options actualizado — 4.2.5 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Classic Widgets — 2000000+ instalaciones activas — 98/100 (272) — PHP máx. 8.4
• Custom Sidebars – Dynamic Sidebar Classic Widget Area Manager — 100000+ instalaciones activas — 94/100 (1028) — PHP máx. 8.4
• Classic Editor + — 40000+ instalaciones activas — 98/100 (31) — PHP máx. 8.4
• Content Aware Sidebars – Fastest Widget Area Plugin — 30000+ instalaciones activas — 98/100 (724)
• Classic Editor and Classic Widgets — 20000+ instalaciones activas — 100/100 (5)