SiteOrigin Widgets Bundle Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-1058 | WordPress Plugin Vulnerability Report

Plugin Name: SiteOrigin Widgets Bundle

Key Information:

  • Software Type: Plugin
  • Software Slug: so-widgets-bundle
  • Software Status: Active
  • Software Author: gpriday
  • Software Downloads: 37,808,389
  • Active Installs: 600,000
  • Last Updated: February 16, 2024
  • Patched Versions: 1.58.4
  • Affected Versions: <= 1.58.3

Vulnerability Details:

  • Name: SiteOrigin Widgets Bundle <= 1.58.3
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-1058
  • CVSS Score: 6.4
  • Publicly Published: February 12, 2024
  • Researcher: wesley
  • Description: The SiteOrigin Widgets Bundle plugin for WordPress has been identified as vulnerable to Stored Cross-Site Scripting (XSS) attacks in versions up to and including 1.58.3. The vulnerability stems from inadequate input sanitization and output escaping, particularly within the onclick parameter, allowing authenticated users with at least contributor-level access to embed malicious scripts in web pages. These scripts can then be executed by any user accessing the affected page, posing a significant security risk.


The SiteOrigin Widgets Bundle, a widely-used WordPress plugin, contains a vulnerability in versions up to 1.58.3 that permits authenticated Stored Cross-Site Scripting (XSS) attacks. This vulnerability, identified as CVE-2024-1058, has been addressed in the latest version, 1.58.4, providing a crucial security update for all users of the plugin.

Detailed Overview:

This vulnerability was brought to light by the researcher wesley and publicly disclosed on February 12, 2024. It highlights a critical security flaw in the plugin's handling of the onclick parameter, where malicious scripts could be injected and executed without proper authorization. Such vulnerabilities are particularly concerning as they can lead to unauthorized access to sensitive data, session hijacking, and other malicious activities. The issue was partially addressed in version 1.58.3, but a complete fix was not available until the release of version 1.58.4.

Advice for Users:

  • Immediate Action: Users should immediately update the SiteOrigin Widgets Bundle plugin to the patched version, 1.58.4, to mitigate the vulnerability and secure their websites.
  • Check for Signs of Vulnerability: Website administrators are encouraged to review their sites for any unusual or unauthorized content that may have been added through this XSS vulnerability.
  • Alternate Plugins: While the patch in version 1.58.4 addresses this specific vulnerability, users may also consider exploring alternative widget plugins that have a strong track record of security and frequent updates.
  • Stay Updated: Keeping all WordPress plugins up to date is crucial for maintaining site security. Regular updates can prevent vulnerabilities and ensure the highest level of protection against potential threats.


The discovery and subsequent patching of the CVE-2024-1058 vulnerability in the SiteOrigin Widgets Bundle plugin underscore the ongoing challenges and importance of cybersecurity in the WordPress ecosystem. Users are urged to update their plugins promptly to protect their sites from potential exploits. By staying vigilant and adhering to best practices for plugin management, website owners can significantly reduce their risk of security breaches.


In the digital realm, the security of your WordPress site is as crucial as the content it hosts. The recent discovery of a vulnerability in the SiteOrigin Widgets Bundle plugin, designated as CVE-2024-1058, serves as a stark reminder of the ever-present risks lurking in the plugins we rely on to enhance our websites. This vulnerability not only underscores the importance of regular updates but also highlights the potential dangers of overlooking the security aspects of website management, especially for small business owners who juggle myriad responsibilities.

About the Plugin:

The SiteOrigin Widgets Bundle is a popular WordPress plugin that provides users with a collection of widgets to enhance their site's functionality. Developed by gpriday, this plugin boasts over 37 million downloads and powers 600,000 active installations. Its widespread use is a testament to its utility, making any vulnerability within it a concern for a significant portion of the WordPress community.

Vulnerability Details:

CVE-2024-1058 is a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 1.58.3 of the SiteOrigin Widgets Bundle. Discovered by researcher Wesley and published on February 12, 2024, the vulnerability arises from insufficient input sanitization and output escaping within the onclick parameter. This flaw allows authenticated users with contributor-level access or higher to inject malicious scripts into web pages, which can then be executed by any user accessing the affected page.

Risks and Potential Impacts:

The implications of CVE-2024-1058 are far-reaching. Stored XSS vulnerabilities can lead to unauthorized access to user data, session hijacking, and the potential defacement of websites. For small businesses, such security breaches can result in reputational damage, loss of customer trust, and even financial repercussions, emphasizing the critical need for vigilant security practices.

Remediation and Previous Vulnerabilities:

To mitigate this vulnerability, users are urged to update the SiteOrigin Widgets Bundle to the patched version, 1.58.4, which addresses this security issue. This incident isn't isolated; with three previous vulnerabilities reported since November 27, 2023, it's clear that even well-maintained plugins can fall prey to security flaws. Regularly updating plugins and conducting security audits are essential steps in safeguarding your site.


The discovery of CVE-2024-1058 in the SiteOrigin Widgets Bundle plugin is a critical reminder of the dynamic nature of cybersecurity threats in the WordPress ecosystem. For small business owners, staying informed and proactive in updating and securing your WordPress site is not just a best practice but a necessity to protect your digital assets. Balancing business operations with website security might seem daunting, but the consequences of neglect can be far more burdensome. Leveraging resources like automatic updates, security plugins, and professional security services can significantly reduce the risk and ensure the ongoing security of your WordPress site.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

SiteOrigin Widgets Bundle Vulnerability- Authenticated (Contributor+) Stored Cross-Site Scripting – CVE-2024-1058 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment