CVE-2026-78087: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in vektor-inc VK Blocks

CVE-2026-78087 is a stored cross-site scripting vulnerability in the VK Blocks WordPress plugin by vektor-inc. It exists in the Group Block 'linkToPost' feature due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers with contributor-level privileges or above can inject arbitrary scripts that execute in the context of users viewing the compromised pages. This affects all versions from 0 up to and including 1.126.1.

The vulnerability allows authenticated contributors or higher to execute arbitrary scripts in the browsers of users who visit the injected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, and partial confidentiality and integrity impact without availability impact.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the Group Block 'linkToPost' feature to reduce risk.