Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Vk_all_in_one_expansion_unit
(Vektor\-Inc)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 5 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-07-20 | CVE-2024-37956 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vektor,Inc. VK All in One Expansion Unit allows Stored XSS.This issue affects VK All in One Expansion Unit: from n/a through 9.99.1.0. | Vk_all_in_one_expansion_unit | 5.4 | ||
| 2023-02-27 | CVE-2023-0230 | The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | Vk_all_in_one_expansion_unit | 5.4 | ||
| 2023-03-20 | CVE-2023-0937 | The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers | Vk_all_in_one_expansion_unit | 6.1 | ||
| 2023-05-23 | CVE-2023-27926 | Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script. | Vk_all_in_one_expansion_unit | 5.4 | ||
| 2023-05-23 | CVE-2023-28367 | Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script. | Vk_all_in_one_expansion_unit | 5.4 |