The VK All in One Expansion Unit plugin contains a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw allows attackers to inject malicious scripts that are stored and later executed when users view the affected pages. The issue affects versions up to 9.113.3. No official patch or remediation information is currently available, and the vulnerability has not been reported as exploited in the wild.

Successful exploitation of this vulnerability could enable attackers to execute arbitrary JavaScript in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with untrusted input and consider applying temporary mitigations such as input sanitization or disabling vulnerable plugin features if feasible.