Inline Script Exposure in VikWidgetsLoader Plugin for WordPress
CVE-2026-84899
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 5 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-84899?
The VikWidgetsLoader plugin for WordPress prior to version 1.12.0 contains a significant code injection vulnerability. It fails to properly sanitize or escape a block attribute before including it in an inline script. This oversight allows users with Contributor permissions to insert arbitrary JavaScript into posts. As a result, any user who views the post, including administrators responsible for review, may inadvertently execute malicious scripts in their browsers, posing serious security risks.
Affected Version(s)
VikWidgetsLoader 1.11.0 < 1.12.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.