CVE-2025-11265

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_url' and 'vkExUnit_cta_button_text' parameters in all versions up to, and including, 9.112.1. This is due to a logic error in the CTA save function that reads sanitization callbacks from the wrong variable ($custom_field_name instead of $custom_field_options), causing the sanitization to never be applied. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute when a user accesses an injected page.",

• CWE-80

• https://plugins.trac.wordpress.org/browser/vk-all-in-one-expansion-unit/tags/9.112.0.1/inc/call-to-action/package/block/index.php#L259
• https://plugins.trac.wordpress.org/browser/vk-all-in-one-expansion-unit/tags/9.112.0.1/inc/call-to-action/package/block/index.php#L271
• https://plugins.trac.wordpress.org/browser/vk-all-in-one-expansion-unit/tags/9.112.0.1/inc/call-to-action/package/class-vk-call-to-action.php#L198
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3394731%40vk-all-in-one-expansion-unit%2Ftrunk&old=3385606%40vk-all-in-one-expansion-unit%2Ftrunk&sfp_email=&sfph_mail=#file2
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9e5a6158-03d4-4ac7-8a4b-666cedabb433?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11257The LLM Hubspot Blog Import plugin for WordPress is vulnerab…4.3
• CVE-2025-1126A Reliance on Untrusted Inputs in a Security Decision vulner…9.3
• CVE-2025-11260The WP Headless CMS Framework plugin for WordPress is vulner…5.3
• CVE-2025-11261Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2025-11262The Link Whisper Free plugin for WordPress is vulnerable to …7.2
• CVE-2025-11263The Link Whisper Free plugin for WordPress is vulnerable to …6.1
• CVE-2025-11266An out-of-bounds write vulnerability exists in the Grassroot…6.8
• CVE-2025-11267The VK All in One Expansion Unit plugin for WordPress is vul…6.4
• CVE-2025-11268The Strong Testimonials plugin for WordPress is vulnerable t…4.3
• CVE-2025-11269The Product Filter by WBW plugin for WordPress is vulnerable…5.3
• CVE-2025-1127The vulnerability can be leveraged by an attacker to execute…9.1
• CVE-2025-11270The Gutenberg Essential Blocks – Page Builder for Gutenberg …6.4