# VK Blocks <= 1.130.0 - Unauthenticated HTML Injection via Comments

- **ID:** WPSEC-2026-2680
- **Plugin:** VK Blocks (`vk-blocks`), https://wordpress.org/plugins/vk-blocks/
- **Affected versions:** all versions before 1.130.1
- **Fixed in:** 1.130.1 (Update to 1.130.1 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-80
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/vk-blocks
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2680/

## Description

The VK Blocks plugin for WordPress is vulnerable to HTML Injection via comments in all versions up to, and including, 1.130.0. This is due to the plugin adding the style, input, svg and path tags to the KSES allowed HTML list in every context, not only post content, which weakens WordPress's filtering of comments and other low-privilege content. This makes it possible for unauthenticated attackers to inject arbitrary HTML and CSS, such as style blocks and form inputs, into comments where anonymous comments are enabled. This can be used to deface pages or show phishing content.

## References

- https://wpsec.com/vuln/WPSEC-2026-2680/
- https://plugins.svn.wordpress.org/vk-blocks/tags/1.130.1/
- https://wordpress.org/plugins/vk-blocks/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2680/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.