Dynamic Widget Content

Dynamic Widget Content has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Dynamic Widget Content has a vendor fix available, so running the current release closes it.

All of these findings were reported by Athiwat Tiprasaharn (Jitlada). Dynamic Widget Content is installed on roughly 300 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Dynamic Widget Content vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-1268

Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field

Read the full analysis

Vulnerability Records

1 records


2026-02-04 18:42	Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field Dynamic Widget Content <= 1.3.6	`CVE-2026-1268`	6.4 Medium	Athiwat Tiprasaharn (Jitlada)	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv1.4.0

Dynamic Widget Content

Author

Brecht

4.9(8)

98/100

Last Updated

2026-08-19 (25d ago)

Active Installs

300+

Downloads

15,649

Requires WP

3.5+

Requires PHP

Tested up to

WP 7.1

Created

2015-03-23 (12y ago)

The widget will only show if you have set some content for it on the current page. Perfect for creating dynamic widgets that only appear when you need it. Works with any custom post type as well and you can use shortcodes in the widget content! Usage examples: Post summaries Positive and negative points for reviews Index with links for long pages Call to action links … Let us know what you think! Any feedback is welcome.

View on WordPress.org