WordPress plugin
VK All in One Expansion Unit security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 12 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High0
- Medium12
- Low0
All VK All in One Expansion Unit vulnerabilities
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
≤9.118.0Update to 9.119.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.113.3Update to 9.113.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
≤9.112.3Update to 9.112.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.112.1Update to 9.112.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.112.1Update to 9.112.2
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤9.99.1.0Update to 9.99.2.0
- Medium6.5Information Exposure
≤9.95.0.1Update to 9.96.0.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via className
≤9.96.0.1Update to 9.97.0.0
- Medium6.4Stored (Contributor+) Cross-Site Scripting in CTA Post
≤9.88.1.0Update to 9.88.2.0
- Medium6.4Stored (Contributor+) Cross-Site Scripting in Profile Setting
≤9.88.1.0Update to 9.88.2.0
- Medium4.7Reflected Cross-Site Scripting via REQUEST_URI
≤9.87.0.1Update to 9.87.1.0
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤9.85.0.1Update to 9.86.0.0
VK All in One Expansion Unit: common questions
Does VK All in One Expansion Unit have known vulnerabilities?
Yes. VulnCrest Radar lists 12 known vulnerabilities in VK All in One Expansion Unit: 12 medium. None are known to affect version null.
How do I check which version of VK All in One Expansion Unit I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent VK All in One Expansion Unit vulnerability?
CVE-2026-17586, published Sep 17, 2026: VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta. Severity: Medium (CVSS 6.4).
Is any VK All in One Expansion Unit vulnerability listed in CISA KEV?
No. None of the known VK All in One Expansion Unit vulnerabilities is currently listed in the CISA KEV catalog.