Threats tagged 'ghsa-6w9x-4c3f-j6gh'

The VK All in One Expansion Unit plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to and including 9.112.1. This flaw arises from a logic error in the CTA save function, where sanitization callbacks are read from an incorrect variable, resulting in no sanitization being applied. Authenticated users with Contributor-level access or higher can exploit this to inject arbitrary scripts that execute when other users view the affected pages.