WordPress plugin
Essential Widgets security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 3 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium3
- Low0
All Essential Widgets vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤3.0Update to 3.0.1 | CVE-2026-0867 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤2.2.2Update to 2.3 | CVE-2025-67543 | |
| Medium5.4 | Missing Authorization <1.6Update to 1.6 | CVE-2021-24752 |
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
≤3.0Update to 3.0.1
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤2.2.2Update to 2.3
- Medium5.4Missing Authorization
<1.6Update to 1.6
Essential Widgets: common questions
Does Essential Widgets have known vulnerabilities?
Yes. VulnCrest Radar lists 3 known vulnerabilities in Essential Widgets: 3 medium. None are known to affect version null.
How do I check which version of Essential Widgets I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Essential Widgets vulnerability?
CVE-2026-0867, published Feb 4, 2026: Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes. Severity: Medium (CVSS 6.4).
Is any Essential Widgets vulnerability listed in CISA KEV?
No. None of the known Essential Widgets vulnerabilities is currently listed in the CISA KEV catalog.