WP-Safety

HTML Widget Security & Risk Analysis

wordpress.org/plugins/html-widget

Adds a simple HTML widget with syntax highlighting for HTML, CSS and JS.

400 active installs v0.1.0 PHP + WP 4.7+ Updated Jun 30, 2017
codemirrorhtmlwidget
85
A · Safe
CVEs total0
Unpatched0
Last CVENever
Plugin page Download
Safety Verdict

Is HTML Widget Safe to Use in 2026?

Generally Safe

Score 85/100

HTML Widget has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 8yr ago
Risk Assessment

The 'html-widget' plugin, version 0.1.0, demonstrates a strong security posture based on the provided static analysis. The absence of AJAX handlers, REST API routes, shortcodes, and cron events significantly limits its attack surface. Furthermore, the code shows a commitment to secure coding practices with 100% of SQL queries using prepared statements and a high percentage of output being properly escaped. The presence of capability checks, while limited, is also a positive indicator.

Key Concerns

  • Only 78% of output properly escaped
  • No nonce checks found
Vulnerabilities
None known

HTML Widget Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Version History

HTML Widget Release Timeline

No version history available.
Code Analysis
Analyzed Mar 16, 2026

HTML Widget Code Analysis

Dangerous Functions
0
Raw SQL Queries
0
0 prepared
Unescaped Output
4
14 escaped
Nonce Checks
0
Capability Checks
2
File Operations
0
External Requests
0
Bundled Libraries
0

Output Escaping

78% escaped18 total outputs
Attack Surface

HTML Widget Attack Surface

Entry Points0
Unprotected0
WordPress Hooks 4
actionplugins_loadedhtml-widget.php:25
actionadmin_enqueue_scriptshtml-widget.php:28
actionwidgets_inithtml-widget.php:31
filterhtml_widget_contenthtml-widget.php:36
Maintenance & Trust

HTML Widget Maintenance & Trust

Maintenance Signals

WordPress version tested4.8.28
Last updatedJun 30, 2017
PHP min version
Downloads6K

Community Trust

Rating80/100
Number of ratings4
Active installs400
Alternatives

HTML Widget Alternatives

Code Widget

Code Widget

code-widget

A
85

Code widget help to add Short Code, PHP Code, HTML, and Simple Text in widget.

4K No CVEs
Local Time Clock

Local Time Clock

local-time-clock

A
85

Display a clock on your sidebar set automatically to your location's timezone. Select from a choice of clocks, colors and sizes.

1K No CVEs
Widget Classes

Widget Classes

widget-classes

A
85

Widget Classes allows you to add classes to your individual widgets to be used by your theme. This is done by appending an additional form field to th …

1K No CVEs
IFrame Widget

IFrame Widget

iframe-widget

C
63

IFrame widget can display any external HTML page inside an HTML IFrame component.

600 1 unpatched
HTML Special Characters Helper

HTML Special Characters Helper

html-special-characters-helper

A
85

Admin widget on the Add/Edit Post pages for inserting HTML encodings of special characters into the post.

200 No CVEs
Developer Profile

HTML Widget Developer Profile

seothemes

9 plugins · 6K total installs

66
trust score
Avg Security Score
82/100
Avg Patch Time
170 days
View full developer profile
Detection Fingerprints

How We Detect HTML Widget

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/html-widget/assets/styles/min/styles.min.css/wp-content/plugins/html-widget/assets/scripts/min/scripts.min.js
Script Paths
/wp-content/plugins/html-widget/assets/scripts/min/scripts.min.js

HTML / DOM Fingerprints

CSS Classes
widget_htmlhtml-widget
Data Attributes
data-editor-textarea
JS Globals
CodeMirror
FAQ

Frequently Asked Questions about HTML Widget