CVE-2026-78087: VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Contributor-level access or higher can exploit it. The attacker needs permission to create or edit content containing the affected VK Blocks Group Block linkToPost feature.
Which installations are affected?
VK Blocks versions up to and including 1.126.1 are affected. The supplied information does not identify configuration prerequisites beyond use of the affected feature.
What happens after exploitation?
An attacker can store arbitrary web script in a page. That script executes in the browser whenever another user accesses the injected page, with potential impact to confidentiality and integrity.
How can administrators check for compromise?
Review pages created or edited by Contributor-level and higher users for unexpected or suspicious content associated with Group Block linkToPost usage. Affected pages may contain stored script payloads that execute when viewed.