CVE-2026-84899

VikWidgetsLoader WordPress plugin versions before 1.12.0 contain a stored XSS vulnerability via the Gutenberg Block class_suffix attribute. The plugin fails to sanitise or escape this attribute before outputting it inside an inline script. A user with the Contributor role can inject arbitrary Jav...

WordPress VikWidgetsLoader plugin < 1.12.0 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin VikWidgetsLoader versions 1.12.0...