CVE-2026-17586: VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The sanitizetextfield callback applied on save does not strip double-quote characters or on event-handler attributes, and the output filter VkCallToAction::safeksespost() only rewrites disallowed iframe elements while returning all other content verbatim, leaving the injected payload intact in the rendered HTML.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with contributor-level access or higher. The attack does not require victim interaction from the attacker to store the payload, but the script runs when someone later views an injected page.
Is this limited to a particular plugin configuration or content field?
The issue is associated with the vkExUnit_cta_img_position post-meta field used by the plugin’s call-to-action functionality. The provided information does not establish that all plugin configurations or unrelated fields are affected.
How can administrators identify possible exploitation?
Review post metadata for vkExUnit_cta_img_position, especially on content created or edited by contributor-level and higher accounts. Look for unexpected double quotes, on* event-handler attributes, or other script-like HTML embedded in that field.
What is the immediate mitigation if updating is not available?
Restrict contributor and other untrusted author-level access, since those roles can supply the stored payload. Review and remove suspicious values from the affected post-meta field, particularly on pages that may have been edited by lower-privileged users.