Known vulnerabilities in SiteOrigin Widgets Bundle

Essential elements for modern websites. Add buttons, sliders, heroes, maps, images, carousels, features, icons, more. Create dynamic pages easily.

9Reported vulnerabilities

5.4Highest CVSS score

1.74.2Latest version

400,000+Active installs

What to do now

Update SiteOrigin Widgets Bundle to 1.71.0 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 24, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2026-2127	Medium 5.4	0.3%	0 to 1.70.4 (inclusive)	`1.71.0`	February 18, 2026
CVE-2024-5901	Medium 5.4	0.4%	Before 1.62.3	`1.62.3`	July 30, 2024
CVE-2024-5090	Medium 5.4	0.3%	Before 1.62.0	`1.62.0`	June 11, 2024
CVE-2024-4362	Medium 5.4	0.4%	Before 1.58.8	`1.58.8`	May 22, 2024
CVE-2024-1723	Medium 5.4	0.5%	Before 1.58.8	`1.58.8`	March 13, 2024
CVE-2024-1070	Medium 5.4	0.5%	Before 1.58.3	`1.58.3`	February 29, 2024
CVE-2024-1058	Medium 5.4	0.4%	Before 1.58.4	`1.58.4`	February 29, 2024
CVE-2024-0961	Medium 5.4	0.5%	1.58.1 and earlier	`1.58.2`	February 5, 2024
CVE-2024-54268	Medium 4.3	0.6%	1.64.0 and earlier	`1.64.1`	December 10, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.