CVE-2026-84899: VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin VikWidgetsLoaderto a version that resolves this vulnerability.Fixed in 1.12.0 - Compensating control
Review and sanitize any pending Gutenberg block submissions created by users with the Contributor role before an administrator publishes/reviews them, to prevent stored JavaScript execution via the block attribute.
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk from the payload?
A user with the WordPress Contributor role can store arbitrary JavaScript in an affected post. The script executes for users who view that post, including an administrator reviewing a pending submission.
Which plugin versions are affected?
VikWidgetsLoader versions before 1.12.0 are affected. Version 1.12.0 is not identified as affected by the provided information.
What input is used to inject the script?
The issue is in the Gutenberg Block class_suffix attribute. The plugin outputs this attribute inside an inline script without sanitising or escaping it.