CVE-2025-11265

15th percentile - higher than 15% of all known CVEs

The VK All in One Expansion Unit plugin for WordPress in versions up to and including 9.112.1 is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters. This is due to a logic error in the CTA save function that reads sanitization callbacks from the wrong variable ($custom_field_name instead of $custom_field_options), causing sanitization to never be applied. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

An attacker can execute arbitrary JavaScript in a victim's browser, potentially leading to session theft, account takeover, or page content modification.

Update the VK All in One Expansion Unit plugin to a version later than 9.112.1. Additionally, consider restricting CTA field editing capabilities for low-privileged users.