The Widget Options - Extended plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) in its 'do_sidebar' shortcode. This vulnerability arises because the plugin does not properly sanitize or escape user input in shortcode attributes, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. When other users access pages containing the injected shortcode, the malicious scripts execute in their browsers. This can lead to information disclosure or session hijacking. The vulnerability affects all versions up to 5.2.1. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with contributor-level or higher access can inject persistent malicious scripts into WordPress pages via the vulnerable shortcode. These scripts execute in the context of users viewing the affected pages, potentially leading to information disclosure or other client-side impacts. The vulnerability does not allow unauthenticated attackers to exploit it, and it does not impact availability. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only to reduce risk. Monitor plugin updates from Marketing Fire, LLC and apply any official patches promptly once available. Avoid using the 'do_sidebar' shortcode with untrusted input where possible.