# VK Blocks <= 1.130.0 - Authenticated (Contributor+) CSS Injection via List Block Color Attribute

- **ID:** WPSEC-2026-2679
- **Plugin:** VK Blocks (`vk-blocks`), https://wordpress.org/plugins/vk-blocks/
- **Affected versions:** all versions before 1.130.1
- **Fixed in:** 1.130.1 (Update to 1.130.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-74
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vk-blocks
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2679/

## Description

The VK Blocks plugin for WordPress is vulnerable to CSS Injection via the List block's 'color' attribute in all versions up to, and including, 1.130.0, due to the color value being added to generated CSS declarations without validation. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary CSS declarations into pages that render the list, and arbitrary CSS rules and limited HTML into the block editor screen when a privileged user opens the post.

## References

- https://wpsec.com/vuln/WPSEC-2026-2679/
- https://plugins.svn.wordpress.org/vk-blocks/tags/1.130.1/
- https://wordpress.org/plugins/vk-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2679/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.