CVE-2026-17586

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit versions prior to 9.118.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via the vkExUnit cta img position Post Meta. The sanitize text field callback fails to strip double-quote characters or on* event-handler attributes during the save process. Additionally, the Vk Call To Action::safe kses post() function only rewrites disallowed iframe elements and returns other content verbatim, allowing injected web scripts to execute when a user accesses the affected page.

Recommendations Update VK All in One Expansion Unit to version 9.118.1 or later.