CVE-2025-11265 is a stored XSS vulnerability in the VK All in One Expansion Unit WordPress plugin due to improper sanitization of user input in the CTA save function. The sanitization callbacks are incorrectly referenced from the variable $custom_field_name instead of $custom_field_options, resulting in no sanitization being applied to the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters. Authenticated attackers with Contributor-level permissions or higher can exploit this to inject arbitrary scripts that execute in the context of users visiting the injected pages.

Successful exploitation allows an authenticated user with Contributor-level access or above to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability and has limited confidentiality and integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or limiting the use of the vulnerable plugin. Monitor vendor channels for updates or patches addressing this issue.