CVE-2026-118983 · Package
NO FIX YET · SEE WHAT TO DO
The VikWidgetsLoader WordPress plugin does not sanitise block attributes before writing them into HTML. A user with the Contributor role can store JavaScript that runs in the browser of anyone who views the post, including administrators and editors.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the VikWidgetsLoader WordPress plugin before 1.12.3 that allow Contributor-role users to submit content. The risk is highest where editors or administrators review and view those submissions. Sites without this plugin, or with it at 1.12.3 or later, are not affected.
Not affected if no-contributor-accounts, plugin-at-1.12.3-or-later
Who cares self-hosted, vikwidgetsloader, wordpress
1.12.3 or laterThe VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.