Currency Converter Widget
Currency Converter Widget has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Currency Converter Widget has a vendor fix available, so running the current release closes it.
All of these findings were reported by Ngô Thiên An (ancorn_). Currency Converter Widget is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-50822Currency Converter Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Read the full analysisVulnerability Records

Currency Converter Widget
Author
currencywiki
Currency Converter Widget is the easiest way to add a professional currency converter to your WordPress site. Powered by Currency.wiki, it offers real-time exchange rates for 170+ world currencies. View Full Documentation Convert currencies on the go with our free Android app: Currency Converter App Key Features 11 Widget Styles – Mini, Square, Tall, Inline, Compact, Mini Chart, Multi Currency, and more 170+ Currencies – All major world currencies with live exchange rates Gutenberg Block – Native WordPress block editor support Shortcode Support – Use [currencywiki_converter] anywhere Customizable – Themes, colors, languages, and display options Responsive – Works perfectly on all devices Fast & Lightweight – Loads asynchronously, no impact on page speed Multi-language – 78 languages supported Historical Charts – Show rate history (selected styles) Widget Styles Mini (250×140) – Minimal footprint Square (250×250) – Perfect for sidebars Tall (200×280) – Vertical layout Inline (480×56) – Single line, great for headers Compact (280×200) – Default balanced style Mini Chart (250×260) – With historical rate chart Multi Expandable (300×400) – Multiple currency converter Multi Fixed (300×340) – Fixed multi-currency view Rates Compact (220×300) – Exchange rates table Rates Viewer (300×500) – Full rates display Rates Viewer Compact (300×400) – Compact rates table Customization Options Theme – Light, Dark, or Auto (system preference) Accent Colors – Blue, Green, Purple, Red, Orange, Slate Default Currencies – Set from/to currencies Display Options – Flags, labels, swap button, branding Number Format – US, European, French, Swiss styles Decimal Places – 0 to 6 decimal precision Lock Currencies – Prevent user changes Language – 78 languages including English, Spanish, French, German, Italian, Portuguese, Russian, Japanese, Korean, Chinese, Arabic, Hindi, Thai, Vietnamese, Turkish, Polish, Dutch, Swedish, and many more Usage Gutenberg Block: Search for “Currency Converter” in the block inserter and customize in the sidebar. Shortcode: [currencywiki_converter] Short Alias: [currencywiki] With Options: [currencywiki_converter style=”compact” theme=”light” from=”USD” to=”EUR” amount=”100″] All Shortcode Attributes: style – Widget style (mini, square, tall, inline, compact, mini-chart, multi-expandable, multi-fixed, rates-compact, rates-viewer, rates-viewer-compact) theme – Theme (auto, light, dark) accent – Accent color hex without # (2563eb, 059669, 7c3aed, dc2626, ea580c, 475569) from – Source currency code (USD, EUR, GBP, etc.) to – Target currency code amount – Default amount lang – Language code – 78 supported (en, es, fr, de, it, pt, pt-br, ru, ja, ko, zh, zh-tw, ar, hi, th, vi, tr, pl, nl, sv, and more) flags – Show flags (1/0) labels – Show labels (1/0) swap – Show swap button (1/0) branding – Show branding (1/0) lock – Lock currency selection (1/0) format – Number format (auto, en-US, de-DE, fr-FR, de-CH) decimals – Decimal places (0-6) External services This plugin relies on an external service to render the widget and to supply live exchange rates: Currency.Wiki, operated by CurrencyWiki Technologies LLC. What the service is and what it is used for The widget is drawn by a small JavaScript embed hosted at widget.currency.wiki. Live exchange rates (and, for the chart styles, historical data) are read from api.currency.wiki, and currency flag images are loaded from cdn.currency.wiki. The plugin does not bundle the widget, the rates, or the flag images; it builds an embed URL and loads them from the service. This is what keeps the plugin small and lets exchange rates stay current without a plugin update. What data is sent, and when On every page view where the widget is displayed, the visitor’s browser loads the widget from https://widget.currency.wiki/v3/ — either the script.js injector or the /v3/embed iframe, depending on the embed method you chose. To show live numbers it then requests current rates, and for chart styles historical data, from https://api.currency.wiki, and flag images from https://cdn.currency.wiki/flags/. These requests carry the display settings you configured — currency pair, amount, style, theme, accent color, language, and similar display options — as URL parameters. As with any web request, the visitor’s IP address and user agent are visible to the server. No personal data is collected, and no cookies are set. Exchange rates and flags are public reference data; nothing about your visitor is sent beyond the ordinary contents of an HTTP request. In the WordPress admin, live previews are loaded from https://widget.currency.wiki/v3/embed (flagged preview=1 so they are not counted as a site using the widget) on two screens: the settings dashboard, which shows a live preview and an “All Widget Styles” gallery, and the block editor, which previews the block as you configure it. These send the same display settings listed above; no personal data is sent from the admin. Terms and privacy Terms of Service: https://currency.wiki/terms-of-service Privacy Policy: https://currency.wiki/privacy-policy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C