Unknown VK All In One Expansion Unit vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown VK All In One Expansion Unit, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1MediumCVE-2023-0937unknown · vk all in one expansion unit +2 moreVK All in One Expansion Unit < 9.87.1.0 - Reflected XSSThe VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsersEPSS0.52%6.4MediumCVE-2023-0230unknown · vk all in one expansion unit +2 moreVK All in One Expansion Unit < 9.86.0.0 - Contributor+ Stored XSSThe VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.EPSS0.56%