EUVD-2026-71867
GHSA-gff8-vmj9-6526
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Contributor role = PR:L; stored XSS executes in admin's browser = S:C; no direct availability impact on the vulnerable system itself.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The VikWidgetsLoader WordPress plugin before 1.12.0 does not sanitise or escape a block attribute before outputting it inside an inline script, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator who reviews the pending submission.
AnalysisAI
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Contributor WordPress role must be accessible to the attacker - either through a compromised account or a site policy that allows self-registration at Contributor level. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 6.8 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) conflicts with the CVE description: the description explicitly names the Contributor role as the required privilege level, which corresponds to PR:L in standard CVSS taxonomy, not PR:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update VikWidgetsLoader to version 1.12.0 or later, which is confirmed as the patched release per EUVD-2026-71867 and the WPScan advisory at https://wpscan.com/vulnerability/4e0beb72-d73b-4802-894d-141aadbd8d4f/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today