VK All in One Expansion Unit
vk-all-in-one-expansion-unit · plugin
Known security vulnerabilities for VK All in One Expansion Unit. Find out in seconds which version runs on your site with WP Lens.
8 known vulnerabilities
1 exploitable without logging in · latest Sep 18, 2026
Listed on wordpress.org · latest 9.123.1 · last updated Sep 5, 2026 · 100K+ installs
wordpress.org status checked on Oct 9, 2026
Vulnerabilities
- Medium 6.5
CVE-2026-39483login required≤ 9.113.3
WordPress VK All in One Expansion Unit plugin <= 9.113.3 - Cross Site Scripting (XSS) vulnerability
- Medium 6.4
CVE-2026-17586author+≤ 9.118.0
VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
- Medium 6.4
CVE-2025-11737contributor+≤ 9.112.3
VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
- Medium 6.4
CVE-2025-11267contributor+≤ 9.112.1
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 6.4
CVE-2025-11265contributor+≤ 9.112.1
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 5.4
CVE-2024-37956login required≤ 9.99.1.0
WordPress VK All in One Expansion Unit plugin <= 9.99.1.0 - Cross Site Scripting (XSS) vulnerability
- Medium 5.4
CVE-2024-2170contributor+≤ 9.96.0.1
VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className
- Medium 5.3
CVE-2024-2093unauthenticated≤ 9.95.0.1
VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).