CVE-2026-84899: CWE-79 Cross-Site Scripting (XSS) in VikWidgetsLoader

The VikWidgetsLoader WordPress plugin before version 1.12.0 fails to sanitize or escape a block attribute before embedding it in an inline script. This allows users with Contributor privileges to inject and store arbitrary JavaScript code. When other users, including administrators, view the affected post, the malicious script executes in their browsers, leading to a stored Cross-Site Scripting (XSS) vulnerability classified as CWE-79. The CVSS v3.1 base score is 6.8, reflecting a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed. No official patch or remediation level has been confirmed in the provided data.

Successful exploitation allows an attacker with Contributor role to execute arbitrary JavaScript in the context of other users' browsers, including administrators. This can lead to compromise of user sessions, theft of sensitive information, or other actions permitted by the victim's browser context. The vulnerability affects confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role permissions or avoid using the affected plugin version. Monitor for updates from the vendor regarding patches or official mitigations.