CVE-2026-17586
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_img_position' Post Meta in all versions up to and including 9.118.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.
Risk Assessment
An attacker could steal user data, hijack sessions, or spread malicious content. This may lead to compromise of user security and site reputation.
Recommendation
Update the VK All in One Expansion Unit plugin to the latest version with the fix. Additionally, consider using a web application firewall (WAF) and regularly scan the site for XSS.
Other vulnerabilities in VK All in One Expansion Unit
Original NVD description (English source)
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitize_text_field callback applied on save does not strip double-quote characters or on* event-handler attributes, and the output filter Vk_Call_To_Action::safe_kses_post() only rewrites disallowed iframe elements while returning all other content verbatim, leaving the injected payload intact in the rendered HTML.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS