Executive brief
The VK All in One Expansion Unit plugin for WordPress contains a stored cross-site scripting vulnerability that allows authenticated users with contributor-level access to inject malicious scripts into page content. When other users view an affected page, the injected script executes automatically in their browser, potentially allowing attackers to steal session data, deface content, or perform actions on behalf of legitimate users.
Technical details
This is a stored XSS vulnerability in the WordPress plugin's Call-to-Action (CTA) feature, affecting the 'vkExUnit_cta_img_position' post meta field. The root cause is insufficient input sanitization combined with inadequate output escaping: the sanitize_text_field() function used during save does not strip double-quote characters or on* event-handler attributes, and the output filter Vk_Call_To_Action::safe_kses_post() only rewrites iframe elements while leaving other malicious content intact. The vulnerability requires authenticated access with contributor-level privileges or above. An authenticated attacker can inject arbitrary JavaScript that will execute in the browsers of all users viewing the affected post. Patches are available in versions after 9.118.0.
Affected products
- Vektor VK All in One Expansion Unit up to 9.118.0
Timeline
- 2026-09-18: disclosed