VK Blocks EUVD-2026-101848

Requires an authenticated WordPress account with contributor-level privileges or above (PR:L) on a site running VK Blocks ≤ 1.126.1, and specifically requires use of the Group Block 'linkToPost' feature, whose input is insufficiently sanitized and whose output is improperly escaped. The stored payload executes when any user - including higher-privileged reviewers - subsequently accesses the injected page. Limiting factors: exploitation is gated on obtaining a contributor account (not anonymous), is confined to sites that permit such accounts, and the impact is browser-side script execution (C:L/I:L) rather than direct server compromise; no attacker-side user interaction is required.

This is a moderate-severity stored XSS (CVSS 6.4) whose real-world priority is tempered by its authentication requirement. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) confirms network-reachable, low-complexity exploitation but requires PR:L - i.e. an authenticated contributor-level account - so this is not an unauthenticated internet-facing bug. The scope change (S:C) and low confidentiality/integrity impact reflect script execution in a victim's browser rather than full server compromise. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis; this points to a patch-on-normal-cycle issue rather than an emergency. The main risk amplifier is the low trust bar for contributor accounts on multi-author WordPress sites, where attackers can self-register or where accounts are loosely governed. No data signals conflict; the chief limitation is simply that the input lacks exploitation-probability (EPSS) and exploitation-status (KEV/POC) telemetry, so widespread active exploitation cannot be asserted.

A low-privileged contributor on a WordPress site using VK Blocks edits a Group Block and injects a malicious script through the unsanitized 'linkToPost' feature, then submits the page for review or publication. When an administrator previews the submission or any visitor loads the published page, the stored script executes in their browser, enabling session/cookie theft or admin-context actions. No public POC is referenced, and exploitation requires an existing contributor-level account (PR:L) but no victim interaction beyond normally viewing the page.