{"id":"CVE-2026-118983","kind":"vulnerability","aliases":["CVE-2026-118983"],"related":[],"title":"VikWidgetsLoader WordPress plugin: stored script injection via block attributes","description":"The VikWidgetsLoader  WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.","summary":"The VikWidgetsLoader WordPress plugin does not sanitise block attributes before writing them into HTML. A user with the Contributor role can store JavaScript that runs in the browser of anyone who views the post, including administrators and editors.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","vikwidgetsloader","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-at-1.12.3-or-later"],"how_to_check":"- Check the installed VikWidgetsLoader plugin version in the WordPress admin plugin list\n- Review posts with Contributor-authored content that use VikWidgetsLoader blocks","fix":"- VikWidgetsLoader: `1.12.3` or later","status":"open","published_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","triaged_at":"2026-11-04T06:26:05+00:00","updated_at":"2026-11-04T06:26:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:05Z","model":"claude-haiku-5-5","output":{"fix":"- VikWidgetsLoader: `1.12.3` or later","reach":"internet","title":"VikWidgetsLoader WordPress plugin: stored script injection via block attributes","impact":"medium","summary":"The VikWidgetsLoader WordPress plugin does not sanitise block attributes before writing them into HTML. A user with the Contributor role can store JavaScript that runs in the browser of anyone who views the post, including administrators and editors.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vikwidgetsloader","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in administrator's browser, enabling session takeover","analyst_note":"","how_to_check":"- Check the installed VikWidgetsLoader plugin version in the WordPress admin plugin list\n- Review posts with Contributor-authored content that use VikWidgetsLoader blocks\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-at-1.12.3-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the VikWidgetsLoader WordPress plugin before 1.12.3 that allow Contributor-role users to submit content. The risk is highest where editors or administrators review and view those submissions. Sites without this plugin, or with it at 1.12.3 or later, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000685,"input_tokens":4136,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118983':12A,15A '-2026':11A,14A '1.12.3':65C 'administr':57B,104C 'affect':100C 'allow':80C 'anyon':51B 'arbitrari':88C 'attribut':9A,30B,73C,79C 'block':8A,29B,72C 'browser':49B,94C 'contributor':40B,84C 'cve':10A,13A 'editor':59B,106C 'escap':70C 'execut':91C 'host':19B 'html':35B,78C 'includ':56B,102C 'inject':6A 'insid':77C 'javascript':44B,89C 'output':75C 'packag':16B 'pend':110C 'plugin':3A,25B,63C 'post':55B,101C 'review':108C 'role':41B,85C 'run':46B 'sanitis':28B,68C 'script':5A 'self':18B 'self-host':17B 'sever':71C 'store':4A,43B,87C 'submiss':111C 'user':37B,81C,97C 'via':7A 'view':53B,98C 'vikwidgetsload':1A,20B,23B,61C 'wordpress':2A,21B,24B,62C 'write':32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the VikWidgetsLoader WordPress plugin before 1.12.3 that allow Contributor-role users to submit content. The risk is highest where editors or administrators review and view those submissions. Sites without this plugin, or with it at 1.12.3 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","vikwidgetsloader","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118983","severity":null,"published_at":"2026-11-04T06:17:03+00:00","modified_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","fetched_at":"2026-11-04T06:25:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}