Kyokito

**Name of the Vulnerable Software and Affected Versions** VK All in One Expansion Unit versions prior to 9.118.1 **Description** Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via the `vkExUnit cta img position` Post Meta. The `sanitize text field` callback fails to strip double-quote characters or `on*` event-handler attributes during the save process. Additionally, the `Vk Call To Action::safe kses post()` function only rewrites disallowed iframe elements and returns other content verbatim, allowing injected web scripts to execute when a user accesses the affected page. **Recommendations** Update VK All in One Expansion Unit to version 9.118.1 or later.

**Name of the Vulnerable Software and Affected Versions** CSS & JavaScript Toolbox versions prior to 12.0.7 **Description** The plugin is subject to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. The issue exists within the Assignment Engine fields due to insufficient input sanitization and output escaping on data fields including `Expressions`, `URLs`, and `Advanced assignment data`. Authenticated attackers with Administrator-level access or higher can inject arbitrary web scripts that execute when a user accesses the CJT block edit screen in the admin dashboard. **Recommendations** Update the plugin to version 12.0.7 or later. Restrict access to the Assignment Engine fields for `Expressions`, `URLs`, and `Advanced assignment data` to minimize the risk of exploitation.