VikWidgetsLoader CVE-2026-84899

The Contributor WordPress role must be accessible to the attacker - either through a compromised account or a site policy that allows self-registration at Contributor level. The target site must have the VikWidgetsLoader plugin installed and active at version 1.11.0 or earlier. Exploitation requires an administrator (or any higher-privileged user) to view or review the attacker's post in their browser, which is the standard editorial workflow on multi-author sites; this UI:R condition limits opportunistic mass exploitation but is a routine event on any site with pending-submission review. No special server configuration or non-default WordPress settings are required beyond the presence of the plugin and a Contributor-level account.

The provided CVSS 6.8 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) conflicts with the CVE description: the description explicitly names the Contributor role as the required privilege level, which corresponds to PR:L in standard CVSS taxonomy, not PR:H. This discrepancy likely suppresses the published base score; a PR:L/S:C vector would score higher and more accurately reflect the Contributor → admin escalation path. SSVC rates Technical Impact as 'total' despite Exploitation being 'none', correctly capturing that a successful payload fully compromises the target session. EPSS of 0.15% at the 5th percentile and no CISA KEV listing suggest opportunistic mass exploitation has not materialized, but the WPScan-published proof-of-concept lowers the bar for targeted attacks. For any multi-author WordPress site where untrusted contributors submit content, this is a realistic admin-compromise vector that deserves priority patching despite the deceptively moderate CVSS score.

An attacker registers or compromises a Contributor account on a WordPress site using VikWidgetsLoader, then creates a new post and sets a vulnerable block attribute to a crafted JavaScript payload (e.g., a cookie-stealing script targeting document.cookie). The post is submitted for editorial review; when an administrator opens the pending-posts queue and previews or edits the post, the inline script fires in the admin's browser, silently exfiltrating the admin session cookie to an attacker-controlled endpoint and enabling full site takeover. A public proof-of-concept published by WPScan demonstrates this attack path.