Stored Cross-Site Scripting Vulnerability in VK All in One Expansion Unit Plugin

CVE-2025-11265

What is CVE-2025-11265?

The VK All in One Expansion Unit plugin for WordPress has a Stored Cross-Site Scripting vulnerability that affects all versions up to and including 9.112.1. This flaw arises from a logic error in the CTA save function, which incorrectly references sanitization callbacks, failing to apply necessary sanitation to the user input. As a result, authenticated users with Contributor access and higher can inject arbitrary web scripts into web pages. When these pages are accessed by other users, the injected scripts are executed, potentially compromising user data and security.

References