CVE-2025-11267

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_veu_custom_css' parameter in all versions up to, and including, 9.112.1. This is due to insufficient input sanitization and output escaping on the user-supplied Custom CSS value. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.

• CWE-80

• https://plugins.trac.wordpress.org/browser/vk-all-in-one-expansion-unit/tags/9.112.0.1/admin/class-veu-metabox.php#L178
• https://plugins.trac.wordpress.org/browser/vk-all-in-one-expansion-unit/tags/9.112.0.1/inc/css-customize/css-customize-single.php#L32
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3393317%40vk-all-in-one-expansion-unit%2Ftrunk&old=3385606%40vk-all-in-one-expansion-unit%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8996a0f0-8a49-4310-917b-62172c12afdb?source=cve

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11260The WP Headless CMS Framework plugin for WordPress is vulner…5.3
• CVE-2025-11261Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2025-11262The Link Whisper Free plugin for WordPress is vulnerable to …7.2
• CVE-2025-11263The Link Whisper Free plugin for WordPress is vulnerable to …6.1
• CVE-2025-11265The VK All in One Expansion Unit plugin for WordPress is vul…6.4
• CVE-2025-11266An out-of-bounds write vulnerability exists in the Grassroot…6.8
• CVE-2025-11268The Strong Testimonials plugin for WordPress is vulnerable t…4.3
• CVE-2025-11269The Product Filter by WBW plugin for WordPress is vulnerable…5.3
• CVE-2025-1127The vulnerability can be leveraged by an attacker to execute…9.1
• CVE-2025-11270The Gutenberg Essential Blocks – Page Builder for Gutenberg …6.4
• CVE-2025-11271The Easy Digital Downloads plugin for WordPress is vulnerabl…5.3
• CVE-2025-11272A vulnerability has been found in SeriaWei ZKEACMS up to 4.3…5.4