Threats tagged 'ghsa-qf98-j8r3-w7wv'

The VK All in One Expansion Unit WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the '_veu_custom_css' parameter. This affects all versions up to and including 9.112.1. The flaw arises from insufficient sanitization and escaping of user-supplied Custom CSS values, allowing authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.