CVE-2026-14158
|
| |
|
|
Affected software |
WORDPRESS |
|
|
|
The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-14158 |
