Executive brief
VikWidgetsLoader is a WordPress plugin that provides custom content blocks for the Gutenberg editor. The plugin fails to properly escape user input in CSS class fields, allowing contributors to inject malicious JavaScript that executes when posts are viewed by any user, including administrators. An attacker with contributor-level access can craft a specially formatted post that runs arbitrary code in the browsers of all site visitors.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Custom Text and other Gutenberg blocks within VikWidgetsLoader. The plugin accepts a "class_suffix" block attribute without proper sanitization or escaping before outputting it into an inline script context. An authenticated user with Contributor role can inject arbitrary JavaScript through this attribute via the WordPress REST API, which persists in the post content. When an Editor or Administrator publishes the post, the malicious script executes in their authenticated session; subsequently, the script executes for all visitors viewing the published post. The vulnerability affects multiple blocks including Custom Text, Category Post, Counter, Icons, and Text Slide. The issue is fixed in version 1.12.0.
Affected products
- Vik VikWidgetsLoader before 1.12.0
Timeline
- 2026-09-03: disclosed
- 2026-09-05: patched: Fixed in version 1.12.0