The vulnerability allows an authenticated Contributor or higher user to store malicious JavaScript during the creation or editing of a call‑to‑action block. The underlying logic error prevents sanitization from being applied to the URL and button text fields, so any script entered is persisted to the database and executes whenever a page containing the block is viewed. This form of stored XSS can lead to session hijacking, defacement, or redirection to malicious sites for any visitor who loads the affected page.

The flaw exists in the VK All in One Expansion Unit WordPress plugin released by kurudrive, affecting all versions up to and including 9.112.1.

The CVSS score of 6.4 indicates moderate severity; the EPSS score of <1% shows a very low likelihood of exploitation at the present time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, because the attack requires only Contributor‑level access within a WordPress site, the number of potential attackers is non‑trivial. A successful exploitation would allow the attacker to run client‑side code in the browsers of any user who visits a page containing the compromised CTA block, potentially compromising user sessions or delivering additional malware.