CVE-2026-78087

Executive Summary

CVE-2026-78087 is a stored cross-site scripting (XSS) vulnerability in the VK Blocks plugin for WordPress, affecting all versions up to and including 1.126.1. The flaw resides in the Group Block "linkToPost" feature, where insufficient input sanitization and output escaping allow an authenticated attacker with contributor-level access or higher to inject arbitrary web scripts into pages. When a victim views an injected page, the malicious script executes in their browser session, enabling session theft, content manipulation, and other client-side attacks.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly "Cross-site Scripting"), specifically the stored/persistent variant. The root cause, as described, involves the Group Block "linkToPost" feature within the VK Blocks plugin. Stored XSS occurs when attacker-supplied input is persisted by the application (for example, into a post's content or block attributes) and subsequently rendered into HTML without adequate output encoding. In this case, two failure conditions are present: insufficient input sanitization at the point where the "linkToPost" value is accepted and stored, and insufficient output escaping when that stored value is emitted into the rendered page.

Because WordPress block-based content is stored as structured markup and the "linkToPost" feature references another post, the injection point is tied to how that reference is generated and rendered. The NVD description does not specify the exact parameter name, function, class, or field beyond "linkToPost," so the precise sink cannot be enumerated. What is technically certain is the exploit primitive: a low-privileged authenticated user contributes content through the editor, the plugin fails to neutralize special characters or script-bearing markup, and the resulting page serves executable JavaScript to every visitor.

The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, has several notable characteristics. The Scope change (S:C) reflects that the vulnerability in the plugin can affect resources beyond its own security scope — an injected script executes in the origin of the hosting WordPress site, impacting the entire site's users rather than only the plugin's component. The privileges required (PR:L) confirm that an attacker must already hold a legitimate account, and the UI:N rating indicates no user interaction is needed beyond simply loading the affected page for the payload to fire. Integrity and confidentiality impacts are both rated Low, and there is no availability impact. The base score assigned by the vector is 6.4 (Medium).

The attack surface is the WordPress editor and block rendering pipeline. Contributor-level users can create and submit posts with block content, meaning the pre-existing trust granted to that role — the ability to author content — is abused to persist a script. This distinguishes the issue from reflected XSS, where the payload is not persisted; here the payload remains stored in the post and re-executes on each subsequent view until removed.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code was available at the time of this report. The attack chain below is inferred strictly from the vulnerability class (stored XSS via a block feature) and the NVD description; no specific function names, endpoints, or parameter values beyond "linkToPost" are asserted.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running the VK Blocks plugin at a version at or below 1.126.1. This can be done by enumerating plugin assets or page markup that references the plugin. The attacker confirms they hold, or can obtain, an account with contributor-level access or above, since WordPress allows registration or assignment of such roles depending on site configuration.

2. Triggering the flaw class. Using the WordPress editor, the attacker creates or edits a post containing a Group Block that uses the "linkToPost" feature. Because input sanitization is insufficient, the attacker supplies script-bearing content through the value associated with that feature. Because output escaping is also insufficient, the plugin persists this value and later emits it into the page without neutralizing it.

3. Payload execution. When any visitor — including administrators, editors, or unauthenticated readers — loads the injected page, the stored script is rendered as part of the page and executes in the victim's browser within the security context of the affected site. The payload can perform any action a script can on that origin, such as reading accessible cookies or tokens, issuing requests with the victim's privileges, or altering displayed content.

4. Post-exploitation impact. The most severe consequence of a stored XSS on a CMS is privilege escalation by proxy: if an administrator views the injected page, script running as that user can perform privileged actions on their behalf, potentially enabling creation of admin accounts, modification of content, or installation of malicious plugins. Even without an admin victim, the attacker can exfiltrate session data, redirect users, serve credential-harvesting overlays, or deface pages.

The attack requires an authenticated account (contributor or above) and no victim interaction beyond page load. There is no evidence in the provided data of exploitation in the wild, and no public PoC exists; this assessment describes the vulnerability class and mechanism rather than a confirmed exploit.

Impact Assessment

Successful exploitation results in arbitrary JavaScript execution in the context of the affected WordPress site. The confidentiality and integrity impacts are rated Low under the CVSS vector, reflecting that a single XSS instance has bounded direct effect on data, but the Scope:Changed rating is the critical multiplier: the injected script is not confined to the vulnerable plugin component and instead operates across the hosting origin. This means the blast radius includes all users who view the injected page, not merely the attacker who created it.

Business consequences include theft of session cookies and authenticated tokens, unauthorized actions performed as privileged users who view the page, widespread content defacement, redirection of site visitors to attacker infrastructure, and delivery of further client-side malware or credential phishing. Because contributor access is a common and relatively low-trust WordPress role, the effective barrier to entry for an attacker is modest. Sites that allow self-registration or grant contributor roles broadly are at higher risk, particularly where administrators routinely preview or approve contributor content — the exact action that causes them to load an injected page.

The absence of a confirmed patch, public exploit, and KEV listing lowers the immediate, known-exploited risk, but the persistent nature of stored XSS and the presence of an easily obtainable prerequisite (a contributor account) warrant prompt attention. There is no availability impact.

Detection Guidance

Sigma Rule

title: Potential VK Blocks linkToPost Stored XSS Content Submission
id: 8f4c2b6a-3d1e-4f7a-9c2b-1a5e6d7c8b90
status: experimental
description: Detects WordPress post content submissions referencing the VK Blocks linkToPost feature that contain script-bearing markup, indicative of stored XSS abuse (CVE-2026-78087).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78087
author: valtersit.com
date: 2026-01-01
logsource:
  product: wordpress
  service: web
detection:
  selection_method:
    http.method: 'POST'
  selection_endpoint:
    cs-uri-stem|contains:
      - '/wp-admin/post.php'
      - '/wp-json/wp/v2/posts'
      - '/wp-admin/admin-ajax.php'
  selection_payload:
    http.request.body|contains:
      - 'linkToPost'
  selection_script:
    http.request.body|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
  condition: selection_method and selection_endpoint and selection_payload and selection_script
falsepositives:
  - Legitimate authors embedding trusted embeds or documentation containing script tags
level: medium
tags:
  - attack.t1059.007
  - cve.2026.78087

YARA Rule

rule CVE_2026_78087_VKBlocks_Stored_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects stored XSS payloads targeting the VK Blocks Group Block linkToPost feature (CVE-2026-78087)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78087"
        date = "2026-01-01"
        cve = "CVE-2026-78087"
    strings:
        $lk = "linkToPost" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "document.cookie" ascii nocase
    condition:
        $lk and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78087 VK Blocks linkToPost Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/"; http.request_body; content:"linkToPost"; http.request_body; content:"<script"; nocase; classtype:web-application-attack; reference:cve,2026-78087; sid:202678087; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST"
     and http.request.body.text contains "linkToPost"]
  [network where network.protocol == "http" and http.request.method == "POST"
     and (http.request.body.text contains "<script" or http.request.body.text contains "javascript:" or
          http.request.body.text contains "onerror=" or http.request.body.text contains "onload=")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=wordpress
| eval body=coalesce(http_request_body, form_data, post_body, "")
| where match(body, "(?i)linkToPost") AND (match(body, "(?i)<script") OR match(body, "(?i)javascript:") OR match(body, "(?i)on(error|load)="))
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths by src_ip, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,wordpress,">
  <rule id="100787" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">wp-admin|wp-json</field>
    <field name="body">linkToPost</field>
    <regex>linkToPost</regex>
    <description>CVE-2026-78087: Possible VK Blocks linkToPost stored XSS payload submitted</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_78087,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single source (NVD) claims a patch exists, but this has not been independently confirmed and no vendor advisory, fix version, or workaround is available. Treat any remediation as provisional until the vendor publishes a validated release.

1. Immediate mitigations:

• Restrict the contributor role. Review who holds contributor access and above, and disable self-registration or open authoring if not required. Since the flaw requires an authenticated account, reducing the number of low-trust accounts directly reduces exposure.
• Sanitize at the edge. If a Web Application Firewall is in place, deploy rules to flag requests containing the "linkToPost" value combined with script-bearing markup, as reflected in the detection content above. Note that WAF coverage is a compensating control, not a fix.
• Enforce Content Security Policy. A restrictive CSP that disallows inline script and untrusted script sources can prevent injected scripts from executing even when stored, though WordPress deployments often require tuning to avoid breaking legitimate functionality.
• Review existing content. Search stored posts for "linkToPost" values containing "<script", "javascript:", or event-handler attributes ("onerror=", "onload=") and remove or sanitize any matches.

2. Patch / upgrade steps:

• Monitor the VK Blocks plugin's official distribution channel for a version above 1.126.1 and apply it once the vendor confirms the fix. Do not rely solely on the NVD claim of a patch.
• Before upgrading, back up the database and files, and test on a staging copy, since block content changes can affect stored markup.
• After upgrading, re-scan previously authored content for residual stored payloads, as patching the code does not automatically cleanse already-persisted malicious values.

3. Long-term hardening:

• Apply the principle of least privilege to WordPress roles; authors should not hold capabilities they do not need.
• Require output encoding and input validation as standard development practice for any block feature that renders stored values.
• Enable audit logging of post creation and edits, and monitor for contributions from low-privilege accounts that contain executable markup.
• Maintain a patch-management process that tracks WordPress plugin vulnerabilities and validates patch claims against vendor advisories rather than relying on a single aggregator source.

References

• NVD — CVE-2026-78087: https://nvd.nist.gov/vuln/detail/CVE-2026-78087
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1059.007 — Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• WordPress Plugin Security / Hardening guidance: https://wordpress.org/support/article/hardening-wordpress/
• VK Blocks plugin distribution page (monitor for patched release above 1.126.1): https://wordpress.org/plugins/vk-blocks/

No CISA KEV listing, public PoC, Nuclei template, or exploit-in-the-wild evidence was identified for this CVE in the provided data. No threat actor campaign has been associated with this vulnerability at the time of writing.