CVE-2026-84899

VikWidgetsLoader WordPress plugin versions before 1.12.0 contain a stored XSS vulnerability via the Gutenberg Block class_suffix attribute. The plugin fails to sanitise or escape this attribute before outputting it inside an inline script. A user with the Contributor role can inject arbitrary Jav...