CVE-2026-118983

UNKNOWN 0.0

VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.

Vendor	unknown
Product	vikwidgetsloader
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for unknown vikwidgetsloader

Be the first to know when new unknown vulnerabilities affecting unknown vikwidgetsloader are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / VikWidgetsLoader

0 < 1.12.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/1c001ad0-6230-4c36-b859-f2225a98f4a5/

Credits

Salúa Es-sair WPScan