CVE-2026-118983
Last modified
CVE-2026-118983 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | VikWidgetsLoader | < 1.12.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-118983?
How severe is CVE-2026-118983?
How do I fix CVE-2026-118983?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-11895The HT Mega Addons for Elementor – Elementor Widgets & Templ…6.4
- CVE-2026-118952A flaw was found in the Kroxylicious ACL authorizer. Its pre…6.5
- CVE-2026-118959A flaw was found in the required action provider mechanism o…5.4
- CVE-2026-11896The My Calendar – Accessible Event Manager plugin for WordPr…5.3
- CVE-2026-11897IBM WebSphere Application Server - Liberty 17.0.0.3 through …7.5
- CVE-2026-11898The White Label CMS plugin for WordPress is vulnerable to St…4.4
- CVE-2026-118984OmniRoute 3.8.0 before 3.8.52 contains an unverified passwor…5.5
- CVE-2026-118986CallBackery versions before 0.62.0 for Perl allow session co…7.5
- CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session c…5.3
- CVE-2026-118988CallBackery versions before 0.60.1 for Perl let unauthentica…7.5
- CVE-2026-118989WebToffee Product Import Export for WooCommerce 2.5.1 before…5.5
- CVE-2026-11899The PDF Builder for WooCommerce. Create invoices,packing sli…4.3
Are you affected by CVE-2026-118983?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST