CVE-2025-11737

The VK All in One Expansion Unit plugin contains a security flaw affecting all versions up to 9.112.3, which allows malicious users with contributor or higher privileges to introduce unauthorized code into WordPress sites through the 'vkExUnit_sns_title' field. This vulnerability stems from inadequate filtering of input data and insufficient protection against untrusted content being displayed on the site. As a result, attackers can create pages that execute their injected scripts when accessed by other users.

Based on public CVE data (MITRE/NVD).