CVE-2025-11265: VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Vulnerability summary

CVE-2025-11265 is a medium (CVSS 6.4) vulnerability in kurudrive vk all in one expansion unit. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 14.9% of scored vulnerabilities. Fixed in 9.112.2.

Timeline

1. 18-11-2025
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters in all versions up to, and including, 9.112.1. This is due to a logic error in the CTA save function that reads sanitization callbacks from the wrong variable ($custom_field_name instead of $custom_field_options), causing the sanitization to never be applied. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute when a user accesses an injected page.",

• CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.