JavaScript Execution Flaw in VikWidgetsLoader Plugin by WordPress
CVE-2026-118983

Currently unrated

Key Information:

Vendor

WordPress
Status
Vikwidgetsloader
Vendor
CVE Published:
4 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-118983?

The VikWidgetsLoader plugin for WordPress, prior to version 1.12.3, has a security issue where it fails to properly sanitize or escape multiple block attributes before embedding them in HTML output. This weakness permits users with Contributor roles to inject arbitrary JavaScript into posts, which then executes in the browsers of any users who view the affected content, including site administrators and editors reviewing submissions. Such an attack vector can lead to significant security breaches, as it allows for the manipulation of content and execution of malicious scripts.

Affected Version(s)

VikWidgetsLoader 0 < 1.12.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-118983 - Proof of Concept

References

https://wpscan.com/vulnerability/1c001ad0-6230-4c36-b859-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Salúa Es-sair
WPScan
.