---
id: "CVE-2026-118983"
kind: "vulnerability"
aliases: ["CVE-2026-118983"]
title: "VikWidgetsLoader WordPress plugin: stored script injection via block attributes"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "vikwidgetsloader", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-at-1.12.3-or-later"]
published_at: "2026-11-04T06:17:03+00:00"
first_seen_at: "2026-11-04T06:25:19+00:00"
updated_at: "2026-11-04T06:26:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118983", "first_seen_at": "2026-11-04T06:25:19+00:00"}]
---

# VikWidgetsLoader WordPress plugin: stored script injection via block attributes

The VikWidgetsLoader WordPress plugin does not sanitise block attributes before writing them into HTML. A user with the Contributor role can store JavaScript that runs in the browser of anyone who views the post, including administrators and editors.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed VikWidgetsLoader plugin version in the WordPress admin plugin list
- Review posts with Contributor-authored content that use VikWidgetsLoader blocks

## Fix

- VikWidgetsLoader: `1.12.3` or later

## Timeline

- 2026-11-04T06:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118983

## From the sources

The VikWidgetsLoader  WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_