CVE Database /
CVE-2023-0937
CVE · Medium
CVE-2023-0937 — VK All in One Expansion Unit [vk-all-in-one-expansion-unit] < 9.87.1.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-0937
|
VK All in One Expansion Unit [vk-all-in-one-expansion-unit] < 9.87.1.0 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 9.87.1.0
|
9.87.1.0 |
2023-02-22 |
—
|
CVE-2023-0937
The VK All in One Expansion Unit plugin for WordPress contains a reflected cross-site scripting vulnerability in versions 9.87.0.1 and earlier stemming from inadequate sanitization and escaping of the $_SERVER['REQUEST_URI'] parameter. Unauthenticated attackers can craft malicious links containing arbitrary JavaScript code that executes in the victim's browser when clicked, though this vulnerability is only effective in older browser versions. The flaw was fixed in version 9.87.1.0.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings