CVE-2025-11265

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit plugin for WordPress versions prior to 9.112.1

Description The software is susceptible to Stored Cross-Site Scripting through the vkExUnit cta url and vkExUnit cta button text parameters. This is caused by a logic error in the CTA save function, where sanitization callbacks are read from an incorrect variable, preventing sanitization from being applied. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which will execute when a user accesses the injected page.

Recommendations Update the VK All in One Expansion Unit plugin to version 9.112.1 or later.