The VK All in One Expansion Unit plugin for WordPress suffers from a stored XSS vulnerability due to improper neutralization of input during web page generation. Specifically, the child page index widget fails to properly sanitize and escape user-supplied attributes such as 'className'. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of other users viewing the injected pages. The vulnerability affects all versions up to and including 9.96.0.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and impacts on confidentiality and integrity with no impact on availability. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation allows an authenticated contributor or higher user to inject and execute arbitrary scripts in the context of other users accessing the affected pages. This can lead to unauthorized disclosure of information or modification of content within the affected WordPress site. The vulnerability does not impact availability. The medium CVSS score reflects moderate risk due to the requirement for authenticated access and the potential for confidentiality and integrity impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level permissions to trusted users only and consider disabling or limiting use of the child page index widget in the VK All in One Expansion Unit plugin. Monitor official kurudrive or WordPress plugin sources for updates and apply patches promptly once available.