CVE-2026-118983: VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
Event History
Frequently Asked Questions
Who can exploit this issue and who is at risk from the stored payload?
A user with the WordPress Contributor role can store arbitrary JavaScript in affected Speakers or Cookies Policy block attributes. The JavaScript executes for any user who views the affected post, including administrators and editors reviewing pending submissions.
Does exploitation require an external attacker or authenticated access?
Exploitation requires access to an account with the Contributor role. The provided information does not indicate that unauthenticated users can submit the malicious block content.
Which plugin versions are affected?
VikWidgetsLoader versions before 1.12.3 are affected. Updating to version 1.12.3 or later addresses the affected version range described.