The VK Blocks plugin for WordPress embeds a stored cross‑site scripting flaw within the Group Block titled "linkToPost." Inversions of input validation and output escaping allow an authenticated contributor or higher user to inject arbitrary JavaScript into a page. Because the script executes in the context of any visitor who opens that page, attackers can hijack user sessions, inject malicious code, or alter page content. The damage can range from defacement to credential theft, depending on the victim’s role and privileges on the site.

All installations of the VK Blocks plugin from its initial release through version 1.126.1 are vulnerable. The flaw is present in the vektor‑inc:VK Blocks WordPress plugin, specifically within the linkToPost group block feature. Any WordPress site that has not upgraded beyond 1.126.1 falls under this risk.

The CVSS score of 6.4 indicates a moderate risk level, with the vulnerability exploitable only by users who already possess contributor‑level access. No EPSS or KEV data suggest that widespread exploitation has not yet been observed. Attackers must first authenticate and then use the vulnerable block to place their malicious scripts, after which the scripts run in browsers of all page visitors. The moderate severity, combined with the requirement for authenticated access, means that careful role management can reduce the attack surface, but an out‑of‑band update is recommended.