CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

CVE-2026-84899 VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffix

The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the...

CVE-2026-84899

The VikWidgetsLoader WordPress plugin versions before 1.12.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to sanitize or escape a block attribute before outputting it within an inline script. This allows users with the Contributor role to store arb...