Replace now Radar no. 11 · Quiet

Enhanced Text Widget

What it does: A text widget that also accepts HTML, CSS, JavaScript, shortcodes and PHP.

Why it’s listed: It can run PHP from a widget, and it has seven public advisories on record. It was last updated in 2024. All seven advisories are listed as fixed, but a widget that runs PHP is a powerful tool to leave without upkeep.

View on WordPress.org ↗ Its admin notices on dismissed.fyi ↗ Checked 2026-10-31 Reviewed by Abhishek Deshpande

Active installs: 30k+
Last updated: 2024-07-17
Tested up to: 6.6.11
Rating: 4.9 / 5 (50)
Version: 1.6.7
Maintainers: 1

Is Enhanced Text Widget still maintained?

It has gone over two years without an update, and it has a second warning sign: runs site code.

Quiet: No update for over a year.

Placements are our opinion, based on public evidence. Risk here means a plugin may not get a fix if a problem appears. It doesn’t mean we found a flaw, unless we show an advisory. Going quiet alone never puts a plugin in Replace now.

Updates No release since 2024-07-17. That was 2 yr 3 mo before our check. WordPress.org plugin directory · checked 2026-10-31

Compatibility Tested up to WordPress 6.6.11. WordPress 7.1.4 was current on 2026-10-31. WordPress.org plugin directory · checked 2026-10-31

Security 7 public advisories on record. Details are below. wpvulnerability.net · checked 2026-10-31

Reviews The latest 10 reviews average 5.0 stars, against 4.9 overall. None of them gave 1 or 2 stars. Newest activity: 2023-12-19. We see no negative trend. WordPress.org reviews · checked 2026-10-31

Maintainers 1 listed contributor. No recent support threads. WordPress.org plugin directory · checked 2026-10-31

Usage 1,495 downloads in the last 30 days, including updates. 79.44% of sites run version 1.6. WordPress.org stats · checked 2026-10-31

What to do next

Back up the site, and use a staging copy for any change.
Move your code to one of the alternatives below, then remove this plugin.

If it works today, no need to panic, but don’t leave this for long.

Recommended alternatives to Enhanced Text Widget

Custom HTML block ↗

Built-in HTML, without running PHP.

No extra plugin needed

Code Snippets ↗

Run PHP snippets without editing theme files.

1M+ installs · 4.7 stars · Updated 2026-10-21 · Tested 7.1.4

WPCode ↗

Manage code snippets from one screen.

3M+ installs · 4.9 stars · Updated 2026-10-29 · Tested 7.1.4

Each listed plugin was updated in the last six months, is tested with WordPress 7.0 or newer, and had no open advisory in WPVulnerability when we checked. We have not tried them ourselves. No one pays to appear here.

Security record

Advisory	Severity	Fixed in
CVE-2024-31435 ↗ Access control	Medium (4.3)	1.6.5
CVE-2024-0559 ↗ Cross-site scripting	Medium (6.5)	1.6.6
CVE-2023-49192 ↗ Access control	Medium (5.3)	1.6.4
CVE-2023-38514 ↗ Access control	Medium (4.3)	1.5.8
CVE-2023-3977 ↗ Cross-site request forgery	Medium (4.3)	1.5.8
CVE-2023-0958 ↗ Access control	Medium (6.5)	1.5.8
CVE-2023-23823 ↗ Access control	Medium (4.3)	1.5.9

wpvulnerability.net · checked 2026-10-31

A listed advisory does not mean the current version is exploitable.

Latest reviews

5/5 Very Helpful, Great Support 2023-12-19
5/5 I’ve used and loved this plugin for years! 2022-07-05
5/5 Fast and appropriate support 2020-04-07
5/5 Does the job right 2018-10-20
5/5 Still Working on 4.9.x 2018-06-27

Dates show last activity. Titles are written by WordPress.org users.

Also on this radar: Custom code

PHP Code Widget Replace now
Scripts n Styles Replace now
Custom CSS and JavaScript Replace now
TC Custom JavaScript Replace now
Simple Custom CSS Watch

No one can pay to appear on the radar or to change a placement. How we stay independent

Something wrong, or updated since we checked? Suggest a correction