{
 "id": "WPSEC-2026-2679",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2679/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2679/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2679/index.md",
 "title": "VK Blocks <= 1.130.0 - Authenticated (Contributor+) CSS Injection via List Block Color Attribute",
 "description": "The VK Blocks plugin for WordPress is vulnerable to CSS Injection via the List block's 'color' attribute in all versions up to, and including, 1.130.0, due to the color value being added to generated CSS declarations without validation. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary CSS declarations into pages that render the list, and arbitrary CSS rules and limited HTML into the block editor screen when a privileged user opens the post.",
 "plugin": {
  "slug": "vk-blocks",
  "name": "VK Blocks",
  "full_name": "VK Blocks",
  "wordpress_org": "https://wordpress.org/plugins/vk-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vk-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vk-blocks"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-74"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.130.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.130.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.130.1",
 "remediation": "Update to 1.130.1 or later.",
 "fix_released": "2026-11-05T18:25:50+00:00",
 "published": "2026-11-06T18:40:49+00:00",
 "updated": "2026-11-06T12:02:07.254166+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2679/",
  "https://plugins.svn.wordpress.org/vk-blocks/tags/1.130.1/",
  "https://wordpress.org/plugins/vk-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vk-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-06"
 }
}