The VK All in One Expansion Unit plugin for WordPress contains a stored cross‑site scripting vulnerability. Attackers can inject malicious JavaScript through the '_veu_custom_css' parameter in the custom CSS field. Because the input is not properly sanitized or escaped, the script is stored and executed whenever a user loads a page that includes the injected CSS, allowing the attacker to run arbitrary code in the victim’s browser.

The vulnerability affects the VK All in One Expansion Unit WordPress plugin version 9.112.1 and all earlier releases. Any site running the plugin at these versions is exposed.

The CVSS score is 6.4, indicating medium severity, and the EPSS score is below 1%, suggesting a low probability of exploitation over time. Because the flaw requires an authenticated user with Contributor level or higher, it is commonly attainable on sites that grant such roles. If exploited, an attacker could steal session information, deface site content, or deliver malware to visitors.