SiteOrigin Widgets Bundle Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-0961 |WordPress Plugin Vulnerability Report

Plugin Name: SiteOrigin Widgets Bundle

Key Information:

  • Software Type: Plugin
  • Software Slug: so-widgets-bundle
  • Software Status: Active
  • Software Author: gpriday
  • Software Downloads: 37,152,267
  • Active Installs: 600,000
  • Last Updated: February 1, 2024
  • Patched Versions: 1.58.2
  • Affected Versions: <= 1.58.1

Vulnerability Details:

  • Name: SiteOrigin Widgets Bundle <= 1.58.1
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-0961
  • CVSS Score: 6.4
  • Publicly Published: January 29, 2024
  • Researcher: Webbernaut
  • Description: The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the code editor in all versions up to, and including, 1.58.1 due to insufficient input sanitization and output escaping. Authenticated attackers, with contributor access or higher, can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.


The SiteOrigin Widgets Bundle for WordPress has a vulnerability in versions up to and including 1.58.1 that allows authenticated attackers to inject malicious scripts. This vulnerability has been patched in version 1.58.2.

Detailed Overview:

The vulnerability was identified by the researcher Webbernaut and involves Stored Cross-Site Scripting (XSS) within the plugin's code editor. Due to inadequate input sanitization and output escaping, attackers with at least contributor privileges can embed harmful scripts into web pages. When these pages are accessed by any user, the embedded scripts execute, potentially leading to unauthorized access or other malicious activities. The quick identification and patching of this vulnerability highlight the critical nature of maintaining security in web components.

Advice for Users:

  • Immediate Action: Update to version 1.58.2 immediately.
  • Check for Signs of Vulnerability: Review your website's pages for unexpected or unfamiliar scripts or content.
  • Alternate Plugins: Consider using alternative plugins with similar functionality as a precautionary measure until you're able to update.
  • Stay Updated: Regularly update your plugins to the latest versions to mitigate vulnerabilities.


The swift action by the developers of the SiteOrigin Widgets Bundle to release a patch for this vulnerability emphasizes the importance of keeping software updated. Users should ensure their installations are updated to version 1.58.2 or later to protect against this XSS vulnerability.


In today’s digital age, where online presence is integral to business success, the security of your website cannot be taken lightly. The discovery of a security vulnerability in the SiteOrigin Widgets Bundle—a popular WordPress plugin with over 600,000 active installations—serves as a crucial reminder of the constant vigilance required to protect your digital assets. This vulnerability, identified as CVE-2024-0961, highlights the potential risks that outdated or unpatched software can pose to your website's integrity and user safety.

About the Plugin:

The SiteOrigin Widgets Bundle enhances WordPress websites with a wide range of widgets, making it a favorite among site owners for its versatility and ease of use. Developed by gpriday, this plugin has seen over 37 million downloads, demonstrating its popularity and widespread use within the WordPress community.

Vulnerability Details:

The vulnerability in question, CVE-2024-0961, is classified as Authenticated Stored Cross-Site Scripting (XSS). It affects all versions of the plugin up to and including 1.58.1. This security flaw was publicly disclosed on January 29, 2024, by a researcher known as Webbernaut. The issue arises from insufficient input sanitization and output escaping within the plugin's code editor, allowing attackers with contributor-level access or higher to inject harmful scripts into web pages.

Risks and Potential Impacts:

The primary risk associated with this vulnerability is the unauthorized execution of malicious scripts, which can lead to compromised website integrity, data breaches, and potentially, the hijacking of user sessions. For small business owners, such security breaches can result in significant reputational damage, loss of customer trust, and potential financial liabilities.

Remediation and Advice for Users:

To address this vulnerability, the developers released a patched version of the plugin, 1.58.2. Website owners are urged to update to this latest version immediately to mitigate the risk. Additionally, it's advisable to regularly review your website for unexpected or unfamiliar content, which could indicate a compromise. For those seeking alternatives, considering other plugins with similar functionality may serve as a temporary safeguard until updates are applied.

Previous Vulnerabilities:

It's worth noting that this is not the first time vulnerabilities have been discovered in the SiteOrigin Widgets Bundle. Since November 27, 2023, there has been at least one other documented security issue, emphasizing the importance of regular monitoring and updates to ensure ongoing security.


For small business owners juggling numerous responsibilities, staying abreast of every security vulnerability may seem daunting. However, the consequences of overlooking website security can be far more burdensome. Implementing a routine check for updates, utilizing security plugins, and considering professional security services can significantly reduce the risk and free up valuable time. Remember, in the digital realm, an ounce of prevention is worth a pound of cure. Ensuring that your WordPress site and its plugins are up-to-date is not just about maintaining functionality; it's a critical component of protecting your business and your customers in an increasingly interconnected world.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

SiteOrigin Widgets Bundle Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-0961 |WordPress Plugin Vulnerability Report FAQs

Leave a Comment