CVE-2025-11737

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit plugin for WordPress versions prior to 9.112.3

Description The software is susceptible to Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page. The vulnerable parameter is vkExUnit sns title.

Recommendations Update the VK All in One Expansion Unit plugin to version 9.112.3 or later.