What the vulnerability does
01Description
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions.
CVE-2023-26539
MEDIUM
CVE-2023-26539: WordPress Advanced Text Widget Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)
CVSS base score
5.9/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
Explanation of Vulnerability in Simple Terms
02Summary
Advanced Text Widget versions up to 2.1.2 contain a cross-site scripting (XSS) vulnerability. An authenticated user with high privileges can inject malicious scripts that execute in other users' browsers when they view affected pages. The vulnerability requires user interaction and can affect the confidentiality, integrity, and availability of the site.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view the widget.
Potential impact on your site
04Site Impact
Admins with high privileges could inject scripts affecting other users' sessions and data.
Conditions required to exploit
05Prerequisites
Attacker must have high-level admin privileges and the victim must view a page containing the widget.
Key dates
06Disclosure timeline
June 22, 2023
CVE published
April 28, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2026-15755 Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
CVE-2026-15644 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
CVE-2026-15425 Yoast SEO <= 28.0 - Authenticated (Author+) Stored Cross-Site Scripting via Post Slug (post_name)
CVE-2026-12231 Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image'
CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
