Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

8 records

Vendor: Vektor,Inc. Component: Vk All In One Expansion Unit Clear all filters
TI-2024-01949 CVE-2024-2093 · GHSA-fj2v-p3c3-xxcr

VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure

Priority LOW 36

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.95.0.1 via social meta tags.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00678 Published 2024-04-09 No fix listed CWE-200
TI-2024-02015 CVE-2024-2170 · GHSA-6pcg-34vx-3h95

VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className

Priority LOW 28

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the child page index widget in all versions up to, and including, 9.96.0.1 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0034 Published 2024-03-26 No fix listed CWE-79
TI-2023-12913 CVE-2023-28367 · GHSA-mqcm-5978-hg9g

Cross-site scripting in Vektor,Inc. VK All in One Expansion Unit

Priority LOW 25

Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00613 Published 2023-05-23 No fix listed CWE-79
TI-2023-12516 CVE-2023-27926 · GHSA-vvw9-wjc3-x8vr

Cross-site scripting in Vektor,Inc. VK All in One Expansion Unit

Priority LOW 25

Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00613 Published 2023-05-23 No fix listed CWE-79
TI-2023-00888 CVE-2023-0937 · GHSA-vv4w-4mwj-jh73

VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS

Priority MEDIUM 60

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00519 Published 2023-03-20 Fixed in 9.87.1.0
TI-2023-00220 CVE-2023-0230 · GHSA-57cm-qv68-h33c

VK All in One Expansion Unit < 9.86.0.0 - Contributor+ Stored XSS

Priority MEDIUM 58

The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with t…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0056 Published 2023-02-27 Fixed in 9.86.0.0