Description
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission.
Published: 2026-09-05
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting
Action: Immediate Patch
AI Analysis

Impact

The VikWidgetsLoader WordPress plugin (versions prior to 1.12.0) fails to sanitize or escape the block attribute class_suffix before rendering it inside an inline JavaScript block. This omission allows a user with the Contributor role to store arbitrary JavaScript that is then executed in the browsers of all site visitors who view the post containing the malicious block. The primary security consequence is a stored cross‑site scripting vulnerability that can run client‑side code in an affected user’s browser.

Affected Systems

Any WordPress site that has the VikWidgetsLoader plugin installed and running a version older than 1.12.0 is affected. The plugin is identified by the Unknown:VikWidgetsLoader CNA entry; site administrators should verify the plugin version in their installation or contact the plugin author for confirmation.

Risk and Exploitability

The vulnerability has a CVSS v3.1 score of 6.8, indicating medium severity. The EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. An attacker only needs Contributor‑level access to a WordPress site; submitting or editing a post with a crafted class_suffix value will store the malicious script, which will be delivered to any user who later views the post.

Generated by OpenCVE AI on September 6, 2026 at 14:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update VikWidgetsLoader to version 1.12.0 or later.
  • If updating is not immediately possible, restrict Contributors from adding or editing Gutenberg blocks that use the class_suffix attribute, or remove the attribute entirely from the block configuration.
  • Implement site‑wide input sanitization or add a custom filter that escapes block attributes before rendering, such as via a security plugin that automatically sanitizes inline scripts.

Generated by OpenCVE AI on September 6, 2026 at 14:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 06 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 05 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79

Sat, 05 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Description The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission.
Title VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-09-06T10:36:39.520Z

Reserved: 2026-09-02T15:13:26.478Z

Link: CVE-2026-84899

cve-icon Vulnrichment

Updated: 2026-09-06T10:26:42.701Z

cve-icon NVD

Status : Deferred

Published: 2026-09-05T07:17:14.127

Modified: 2026-09-08T19:09:21.310

Link: CVE-2026-84899

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-06T14:45:07Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')