Vulnerabilities / VK Blocks / WPSEC-2026-2679
VK Blocks <= 1.130.0 - Authenticated (Contributor+) CSS Injection via List Block Color Attribute
Medium 4.3
CWE-74Fixed in 1.130.1
- ID
- WPSEC-2026-2679
- Plugin
- VK Blocks (vk-blocks)
- Affected
- all versions before 1.130.1
- Remediation
- Update to 1.130.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-74
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- VK Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The VK Blocks plugin for WordPress is vulnerable to CSS Injection via the List block's 'color' attribute in all versions up to, and including, 1.130.0, due to the color value being added to generated CSS declarations without validation. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary CSS declarations into pages that render the list, and arbitrary CSS rules and limited HTML into the block editor screen when a privileged user opens the post.
References
- https://wpsec.com/vuln/WPSEC-2026-2679/
- https://plugins.svn.wordpress.org/vk-blocks/tags/1.130.1/
- https://wordpress.org/plugins/vk-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS