Stored Cross-Site Scripting Vulnerability in Dynamic Widget Content for WordPress

CVE-2026-1268

What is CVE-2026-1268?

The Dynamic Widget Content plugin for WordPress has a vulnerability that allows authenticated users with Contributor-level access and above to exploit Stored Cross-Site Scripting (XSS). This vulnerability arises from inadequate input sanitization and output escaping of user-supplied attributes in the widget content field within the Gutenberg editor sidebar. As a result, attackers can inject malicious web scripts into pages, leading to potential execution of harmful scripts when other users access the affected pages.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References