The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to, and including, 1.68.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Metrics
Affected Vendors & Products
References
History
Tue, 08 Jul 2025 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Siteorigin
Siteorigin siteorigin Widgets Bundle |
|
CPEs | cpe:2.3:a:siteorigin:siteorigin_widgets_bundle:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Siteorigin
Siteorigin siteorigin Widgets Bundle |
Wed, 25 Jun 2025 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 25 Jun 2025 02:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to, and including, 1.68.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
Title | SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute | |
Weaknesses | CWE-79 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: Wordfence
Published: 2025-06-25T02:22:07.865Z
Updated: 2025-06-25T15:02:33.343Z
Reserved: 2025-06-03T21:44:03.481Z
Link: CVE-2025-5585

Updated: 2025-06-25T14:52:26.728Z

Status : Analyzed
Published: 2025-06-25T03:15:27.853
Modified: 2025-07-08T14:54:51.113
Link: CVE-2025-5585

No data.