CVE-2026-118983

MediumCVSS 6.8/10Last modified Nov 4, 2026

Description

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	VikWidgetsLoader	< 1.12.3

References

https://wpscan.com/vulnerability/1c001ad0-6230-4c36-b859-f2225a98f4a5/

Timeline

Published: Nov 4, 2026
Last modified: Nov 4, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1189845.5OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys o CVE-2026-1189867.5CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs CVE-2026-1189875.3CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a c CVE-2026-1189887.5CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route. Ever CVE-2026-1189895.5WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_f CVE-2026-118994.3The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all ve CVE-2026-1189905.5CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration ba CVE-2026-1189917.5CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the back CVE-2026-1189928.4CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. resto CVE-2026-1189937.5CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, Fas CVE-2026-1189949.8CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the applic CVE-2026-1189959.1CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is do