The Vulnerability lies in how the VikWidgetsLoader plugin handles a Gutenberg block attribute called class_suffix. The plugin fails to sanitise or escape this attribute before rendering it inside an inline JavaScript snippet. As a result, a user with the Contributor role can inject arbitrary JavaScript. This stored code executes in the browsers of any visitor who views the affected post, which means even an administrator reviewing a pending submission would be exposed to the malicious script. The primary effect is the compromise of confidentiality and integrity of the user session, and it can lead to credential theft or session hijacking.

Any WordPress site that has VikWidgetsLoader installed and running a version earlier than 1.12.0 is affected. The plugin owner is not publicly listed in the CNA data, so site administrators should check their plugin installation for version information or contact the plugin author for confirmation.

The vulnerability carries a high risk because it can be triggered by any contributor on the site, a role that is normally granted to many users. No external exploitation proof of concept is documented, but the nature of a stored XSS makes the attack straightforward for an attacker who gains Contributor level access. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector is a web form where a contributor creates or edits a post containing the malicious class_suffix value. Once stored, the script runs in the browsers of all subsequent users who view the post, including administrators.