CVE-2026-118983
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
49/100
Published: 2026-11-04
Modified: 2026-11-04
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Unknown | VikWidgetsLoader | 0 < 1.12.3 |
| Unknown | VikWidgetsLoader | 0 < 1.12.3 |