Classic Widgets with Block-based Widgets
Classic Widgets with Block-based Widgets has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.5, and the most serious one scores 6.5 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Classic Widgets with Block-based Widgets has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nabil Irawan. Classic Widgets with Block-based Widgets is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-58029Classic Widgets with Block-based Widgets <= 1.0.1 - Missing Authorization
Read the full analysisVulnerability Records
Classic Widgets with Block-based Widgets
Author
Sumit Singh
Classic Widgets with Block-based Widgets allows you to use both widgets screens at the same time. Sometimes, you need to use the classic widget screen for some of the widgets without permanently disabling the block-based widgets. With this plugin, you can access the Classic Widgets screen in Appearance > Classic Widgets and the block-based screen at the usual place in Appearance > Widgets. NOTE:- This plugin uses WordPress filters to create a new classic widget screen. That means it will work as long as WordPress supports the Classic Widgets screen. Links GitHub repository
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C