{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8902", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-12T18:35:51.327Z", "datePublished": "2025-09-23T03:34:34.894Z", "dateUpdated": "2026-04-08T17:10:47.391Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:47.391Z"}, "affected": [{"vendor": "Marketing Fire, LLC", "product": "Widget Options - Extended", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98f8a524-b0b8-4e11-b789-bed3bd257a10?source=cve"}, {"url": "https://widget-options.com/changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-08-14T18:00:29.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-22T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T13:53:04.345060Z", "id": "CVE-2025-8902", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T13:55:17.024Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8902", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-23T13:53:04.345060Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T13:53:10.475Z"}}], "cna": {"title": "Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "Marketing Fire, LLC", "product": "Widget Options - Extended", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.2.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-14T18:00:29.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-22T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98f8a524-b0b8-4e11-b789-bed3bd257a10?source=cve"}, {"url": "https://widget-options.com/changelog/"}], "descriptions": [{"lang": "en", "value": "The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:10:47.391Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8902", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:10:47.391Z", "dateReserved": "2025-08-12T18:35:51.327Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-23T03:34:34.894Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-8902", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-09-23T04:16:01.050", "references": [{"source": "security@wordfence.com", "url": "https://widget-options.com/changelog/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/98f8a524-b0b8-4e11-b789-bed3bd257a10?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:49:39.118835+00:00", "value": {"mitigation_remediation": ["Upgrade the Widget Options \u2013 Extended plugin to the latest version (v5.2.2 or later), which removes the XSS vulnerability.", "If an upgrade is not immediately possible, disable the do_sidebar shortcode or use a server\u2011side filter to strip user\u2011supplied attributes from the shortcode content.", "Revoke or limit contributor\u2011level access to users who do not need it, restricting the pool of potential attackers."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The flaw is present in all releases of Marketing Fire\u2019s Widget Options \u2013 Extended plugin up to and including version 5.2.1. WordPress sites that have this plugin installed at any of those versions and where a user has at least contributor permissions are susceptible. The plugin is distributed via the WordPress repository and can be installed in any WordPress installation. No other vendors or products are listed in the CNA data.", "description_and_impact": "The vulnerability in the widget options plugin is a stored XSS flaw triggered via the do_sidebar shortcode. Authenticated users with contributor access can embed malicious scripts into shortcode attributes. Once a page is accessed, that script runs in the visitor\u2019s browser context, allowing the attacker to steal session cookies, deface content, or conduct phishing. This affects confidentiality by capturing credentials, integrity by tampering content, and availability via potential lock\u2011out. The issue stems from missing input validation and output encoding (CWE\u201179).", "risk_and_exploitability": "The CVSS base score is 6.4, indicating a moderate severity. EPSS is below 1%, implying a low probability that the flaw is actively exploited in the wild, and it is not currently in the CISA KEV list. However, any authenticated user with contributor rights can obtain the necessary access, and the attack can be performed silently through regular content editing flows. Because the script is stored and triggered on page load, attackers can achieve cross\u2011site scripting across all users who view the compromised page. The vulnerability is easy to exploit with no preconditions beyond legitimate contributor credentials; danger increases if many such accounts exist on a site."}}}}, "created": "2026-04-21T03:00:06.374896+00:00", "updated": "2026-04-21T03:00:06.374909+00:00", "vendors": []}