VikWidgetsLoader CVE-2026-118983

Exploitation requires an authenticated account with the Contributor role (per PR, authentication is required) on a site running VikWidgetsLoader prior to 1.12.3; the attacker stores JavaScript inside several block attributes that the plugin outputs into HTML attributes without sanitisation or escaping. The payload does not execute until a higher-privileged user - an administrator or editor - views the attacker's pending submission (UI:R), so a human review action is a hard prerequisite. Limiting factors: no anonymous/unauthenticated path (a contributor foothold is needed), the dependence on a privileged reviewer opening the malicious post, and the fix being present in version 1.12.3 and later. There is no indication special non-default configuration is needed beyond having the plugin installed and allowing contributor-level submissions.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the VikWidgetsLoader WordPress plugin before 1.12.3. The signals point to a moderate, authenticated-only risk rather than a mass-exploitation emergency. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H (6.8), but PR:H conflicts with the description, which states the attacker only needs the Contributor role - a low-privilege authenticated role - so PR:L is more defensible than PR:H; verify with the vendor/WPScan. Exploitation is bounded by UI:R: a higher-privileged user (administrator or editor) must view the attacker's pending post for the payload to fire. EPSS is low at 0.15% (4th percentile) and SSVC records Exploitation: none and Automatable: no, which is consistent with a flaw that requires an authenticated contributor account plus victim review rather than drive-by mass exploitation; SSVC Technical Impact: total aligns with the account-takeover potential of XSS running in an admin session. There is no CISA KEV listing. The vuln.today Decision label is this_month, so it should be remediated on a routine priority schedule - not deferred indefinitely, but not an emergency. Net: a real, patch-worthy issue whose practical risk is gated by needing a contributor foothold and an admin/editor reviewing the content, not a high-CVSS-but-illusory finding, but also not an internet-wide automatable threat.

An attacker who has (or registers/obtains) a Contributor account on a WordPress site running VikWidgetsLoader submits a post containing a crafted block whose attributes carry unescaped JavaScript. When an administrator or editor opens the pending submission to review it, the script executes in their authenticated browser session, enabling actions such as session/cookie theft or admin account takeover. A public PoC reference exists (WPScan) but it is not verified as working exploit code; CVSS AC:L indicates no special timing or complexity is needed once the required contributor access and reviewer interaction are present.