CVE-2026-116615

The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the post_content parameter. This is due to asymmetric parsing between the save-time strip filter (widgetopts_strip_logic_from_blocks()) and the render-time parser (blockopts_filter_before_display()): embedding an inner <!--start_widgetopts literal inside a JSON key causes the write-side json_decode to see a non-class key and skip stripping — persisting the payload verbatim to the database — while the render-side str_replace reconstitutes the key to class, feeding the attacker-controlled logic value directly into @eval.