The flaw is caused by improper handling of user input in the plugin’s web page generation. Malicious scripts can be stored and later executed in the browsers of any visitor who loads the affected page. This allows attackers to hijack sessions, steal data, deface content or execute arbitrary code within the site’s context.

The vulnerability affects WordPress sites using the VK All in One Expansion Unit plugin distributed by Hidekazu Ishikawa. All versions up to and including 9.113.3 are vulnerable; earlier releases newer than 9.113.3 are not impacted.

The CVSS score of 6.5 denotes moderate severity, while an EPSS score below 1% indicates a low probability of exploitation. The issue is not listed in the CISA KEV catalog. An attacker can exploit the weakness by submitting injected script through the plugin’s interface, which is then embedded in the site’s pages for all users. Because the vector is web‑based and does not require privileged access, the overall risk to site visitors is high.