Vulnerabilities / VK Blocks / WPSEC-2026-2680
VK Blocks <= 1.130.0 - Unauthenticated HTML Injection via Comments
Medium 5.3
CWE-80Fixed in 1.130.1
- ID
- WPSEC-2026-2680
- Plugin
- VK Blocks (vk-blocks)
- Affected
- all versions before 1.130.1
- Remediation
- Update to 1.130.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-80
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-06
- Attack surface
- VK Blocks on WPSec AttackSurface
- Fix released
- Published
Description
The VK Blocks plugin for WordPress is vulnerable to HTML Injection via comments in all versions up to, and including, 1.130.0. This is due to the plugin adding the style, input, svg and path tags to the KSES allowed HTML list in every context, not only post content, which weakens WordPress's filtering of comments and other low-privilege content. This makes it possible for unauthenticated attackers to inject arbitrary HTML and CSS, such as style blocks and form inputs, into comments where anonymous comments are enabled. This can be used to deface pages or show phishing content.
References
- https://wpsec.com/vuln/WPSEC-2026-2680/
- https://plugins.svn.wordpress.org/vk-blocks/tags/1.130.1/
- https://wordpress.org/plugins/vk-blocks/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS