CVE-2025-11267

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit plugin for WordPress versions prior to 9.112.1

Description The software is susceptible to Stored Cross-Site Scripting through the veu custom css parameter. Insufficient input sanitization and output escaping on the user-supplied Custom CSS value allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts. These scripts execute when a user accesses an injected page.

Recommendations Update the VK All in One Expansion Unit plugin to a version later than 9.112.1.