Skip to content
Sign in
5.4 Medium

CVE-2023-0230 The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options…

Description

The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Affected products and versions

Product Affected versions Fixed in
VK All in One Expansion Unit 9.86 earliest → < 9.86.0.0 9.86.0.0

Other CVEs of VK All in One Expansion Unit

The 2 CVEs of VK All in One Expansion Unit →
CVE-2023-0937 The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI']… 6.1 Medium
Track this CVE