PLUGIN SECURITY
Is Image Widget safe?
A simple image widget that uses the native WordPress media manager to add image widgets to your site.
What this plugin does
- Slug:
image-widget - Author: Nexcess
- 100000+ active installs
- 98/100 rating (287 reviews on wordpress.org)
- 4719117 all-time downloads
- On WordPress.org since 2008-07-26
adbannerimagesidebarwidget
Maintenance status
- Latest known version: 4.4.12
- Last updated: 2026-04-20 6:22pm GMT
- Tested up to WordPress: 6.7.7
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
2 known CVEs on file for Image Widget. Reported between 2024 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-42643 | Image Widget [image-widget] < 4.4.12 | — | Medium 5.9 | < 4.4.12 | 4.4.12 | 2026-03-17 | ✓ fixed in latest |
| CVE-2024-10939 | Image Widget [image-widget] < 4.4.11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.4.11 | 4.4.11 | 2024-11-22 | ✓ fixed in latest |
How to fix it
Keep Image Widget updated — 4.4.12 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- CookieAdmin – Cookie Consent Banner — 400000+ active installs — 100/100 (4) — max PHP 8.4
- Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website — 50000+ active installs — 96/100 (45) — max PHP 8.4
- AdRotate Banner Manager — 20000+ active installs — 86/100 (655) — max PHP 8.4
- Quads Ads Manager for Google AdSense — 20000+ active installs — 98/100 (1087)
- Meks Easy Ads Widget — 10000+ active installs — 82/100 (14)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.