Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: kurudrive Clear all filters
TI-2026-14421 CVE-2026-17586 · GHSA-738x-57qm-fc2r

Cross-site scripting in kurudrive VK All in One Expansion Unit

Priority LOW 29

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitiz…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00419 Published 2026-09-18 No fix listed CWE-79
TI-2025-10761 CVE-2025-11737 · GHSA-4r69-36rj-xggj

VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title

Priority LOW 28

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_sns_title' parameter in all versions up to, and including, 9.112.3 due to insufficient input sanitizati…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00214 Published 2026-02-18 No fix listed CWE-79
TI-2025-10313 CVE-2025-11265 · GHSA-6w9x-4c3f-j6gh

VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Priority LOW 28

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters in all versions up to, and including, 9.112.1.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00246 Published 2025-11-18 No fix listed CWE-80