Vulnerabilities

TI-2026-11998 CVE-2026-14158 · GHSA-q799-r857-2h8x

Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter

MEDIUM 42

The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00952 Published 2026-07-08 No fix listed CWE-434

TI-2025-42301 CVE-2025-68842 · GHSA-2v7m-mcj3-m7h7

WordPress Widget Logic Visual plugin <= 1.52 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in totalbounty Widget Logic Visual widget-logic-visual allows Reflected XSS.This issue affects Widget Logic Visual: from…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00218 Published 2026-02-20 No fix listed CWE-79

Vulnerabilities

Filters

Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter

WordPress Widget Logic Visual plugin <= 1.52 - Reflected Cross Site Scripting (XSS) vulnerability