{
 "id": "WPSEC-2026-2680",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2680/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2680/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2680/index.md",
 "title": "VK Blocks <= 1.130.0 - Unauthenticated HTML Injection via Comments",
 "description": "The VK Blocks plugin for WordPress is vulnerable to HTML Injection via comments in all versions up to, and including, 1.130.0. This is due to the plugin adding the style, input, svg and path tags to the KSES allowed HTML list in every context, not only post content, which weakens WordPress's filtering of comments and other low-privilege content. This makes it possible for unauthenticated attackers to inject arbitrary HTML and CSS, such as style blocks and form inputs, into comments where anonymous comments are enabled. This can be used to deface pages or show phishing content.",
 "plugin": {
  "slug": "vk-blocks",
  "name": "VK Blocks",
  "full_name": "VK Blocks",
  "wordpress_org": "https://wordpress.org/plugins/vk-blocks/",
  "advisories_url": "https://wpsec.com/vuln/plugin/vk-blocks/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/vk-blocks"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-80"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.130.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.130.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.130.1",
 "remediation": "Update to 1.130.1 or later.",
 "fix_released": "2026-11-05T18:25:50+00:00",
 "published": "2026-11-06T18:40:49+00:00",
 "updated": "2026-11-06T12:02:07.254166+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2680/",
  "https://plugins.svn.wordpress.org/vk-blocks/tags/1.130.1/",
  "https://wordpress.org/plugins/vk-blocks/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/vk-blocks",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-06"
 }
}