VendorsSiteOriginsiteorigin_widgets_bundleany version
Vulnerabilities

SiteOrigin Siteorigin Widgets Bundle any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

10CVEs
CVE-2024-54268
WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability
Published 2024-12-13 · Modified
8.8EPSS 0.006
CVE-2023-6295
so-widgets-bundle < 1.51.0 - Admin+ Local File Inclusion
Published 2023-12-18 · Modified
7.2EPSS 0.010
CVE-2024-0961
SiteOrigin Widgets Bundle <= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-02-05 · Modified
6.4EPSS 0.005
CVE-2024-1070
SiteOrigin Widgets Bundle <= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-02-20 · Modified
6.4EPSS 0.005
CVE-2024-1723
SiteOrigin Widgets Bundle <= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-03-13 · Modified
6.4EPSS 0.005
CVE-2024-1058
SiteOrigin Widgets Bundle <= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published 2024-02-20 · Modified
6.4EPSS 0.004
CVE-2024-5901
SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget
Published 2024-07-30 · Analyzed
6.4EPSS 0.004
CVE-2024-4362
SiteOrigin Widgets Bundle <= 1.60.0 - - Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode
Published 2024-05-22 · Modified
6.4EPSS 0.004
CVE-2024-5090
SiteOrigin Widgets Bundle <= 1.61.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via SiteOrigin Blog Widget
Published 2024-06-11 · Modified
6.4EPSS 0.003
CVE-2025-5585
SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute
Published 2025-06-25 · Analyzed
6.4EPSS 0.002