CVE-2025-11267

MediumCVSS 6.4

Published: 18/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

The VK All in One Expansion Unit plugin for WordPress in versions up to and including 9.112.1 is vulnerable to Stored Cross-Site Scripting via the '_veu_custom_css' parameter. This is due to insufficient input sanitization and output escaping on the user-supplied Custom CSS value. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

Risk Assessment

An attacker can execute arbitrary JavaScript in a victim's browser, potentially leading to session theft, account takeover, or page content modification.

Recommendation

Update the VK All in One Expansion Unit plugin to a version later than 9.112.1. Additionally, consider restricting Custom CSS editing capabilities for low-privileged users.

Other vulnerabilities in VK All in One Expansion Unit WordPress plugin

CVE-2025-11265Medium
The VK All in One Expansion Unit plugin for WordPress in versions up to and including 9.112.1 is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters. This is due to a logic error in the CTA save function that reads sanitization callbacks from the wrong variable ($custom_field_name instead of $custom_field_options), causing sanitization to never be applied. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.

Original NVD description (English source)

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_veu_custom_css' parameter in all versions up to, and including, 9.112.1. This is due to insufficient input sanitization and output escaping on the user-supplied Custom CSS value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS