Vikwidgetsloader
Monthly
Stored cross-site scripting in the VikWidgetsLoader WordPress plugin before 1.12.3 allows an authenticated user holding the Contributor role to embed arbitrary JavaScript in several block attributes that the plugin writes into HTML attributes without sanitisation or escaping. The payload stays inert until a higher-privileged user - typically an administrator or editor opening the pending submission for review - loads the affected post, at which point the script runs in that reviewer's browser session (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 6.8). There is no anonymous path: a Contributor foothold and a human review action are both required. A public PoC reference exists; it is not verified as working exploit code, exploitation is not confirmed (not in CISA KEV), and EPSS is 0.15% (4th percentile), though the scope change and high confidentiality/integrity impact in the reviewer's session keep this in the vendor's monthly remediation window rather than an emergency.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.
Stored cross-site scripting in the VikWidgetsLoader WordPress plugin before 1.12.3 allows an authenticated user holding the Contributor role to embed arbitrary JavaScript in several block attributes that the plugin writes into HTML attributes without sanitisation or escaping. The payload stays inert until a higher-privileged user - typically an administrator or editor opening the pending submission for review - loads the affected post, at which point the script runs in that reviewer's browser session (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, 6.8). There is no anonymous path: a Contributor foothold and a human review action are both required. A public PoC reference exists; it is not verified as working exploit code, exploitation is not confirmed (not in CISA KEV), and EPSS is 0.15% (4th percentile), though the scope change and high confidentiality/integrity impact in the reviewer's session keep this in the vendor's monthly remediation window rather than an emergency.
Stored XSS in VikWidgetsLoader WordPress plugin before 1.12.0 allows Contributor-role users to permanently embed arbitrary JavaScript into posts by supplying a malicious block attribute that is output unsanitized inside an inline script tag. When an administrator reviews the pending submission, the payload executes in their browser, enabling full session hijacking and site takeover without any further attacker interaction. A publicly available exploit exists (via WPScan), though EPSS is low (0.15%, 5th percentile) and SSVC records no confirmed exploitation at this time.