Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-9438: Display‑widgets plugin lets attackers inject malicious code

CVE-2015-9438 · published 7 years ago

Summary

The display‑widgets WordPress plugin lets an attacker add hidden code that runs in a browser when an administrator uses certain widget settings. This could let the attacker display unwanted content or steal information from the admin's session. Update the plugin to version 2.04 or later, or disable/remove it until you can apply the update.

What to do

Update display-widgets_project display-widgets to version 2.04 or later.

Affected software

Vendor	Product	Affected versions
display-widgets_project	display-widgets	< 2.04 `cpe:2.3:a:display-widgets_project:display-widgets::::::wordpress::*`

Original advisory text

The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.

References

http://cinu.pl/research/wp-plugins/mail_a7012199c9236754edd72786637e5d2d.html Exploit Third Party Advisory
https://wordpress.org/plugins/display-widgets/#developers Product Third Party Advisory
https://wpvulndb.com/vulnerabilities/8247 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.4 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published26 Sep 2019

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-9438 · NVD

Track software like this

Free during beta