| Package | Affected versions | Patched versions |
|---|---|---|
| siteorigin widgets bundle | < 1.51.0 | 1.51.0 |
The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free