CVE-2025-11265: VK All in One Expansion Unit XSS Flaw

CVE-2025-11265 Overview

CVE-2025-11265 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the VK All in One Expansion Unit plugin for WordPress. The flaw exists in all versions up to and including 9.112.1. It resides in the Call-to-Action (CTA) save function, which reads sanitization callbacks from the wrong variable and silently skips input sanitization. Authenticated users with Contributor-level access or higher can inject arbitrary web scripts through the vkExUnit_cta_url and vkExUnit_cta_button_text parameters. Injected scripts execute in the browser of any user who views a page containing the malicious CTA content.

Critical Impact
Authenticated contributors can persist JavaScript payloads inside CTA blocks that execute in the context of site visitors and administrators, enabling session theft, account takeover, and further site compromise.

Affected Products

VK All in One Expansion Unit plugin for WordPress
All versions up to and including 9.112.1
Sites permitting Contributor-level accounts or above to author CTA content

Discovery Timeline

2025-11-18 - CVE-2025-11265 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11265

Vulnerability Analysis

The vulnerability is a Stored XSS issue classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page. Attackers who already hold posting privileges on the WordPress site can weaponize a CTA block by placing script payloads into the URL or button text fields. Because the plugin persists the raw input to the database, every subsequent render of the CTA delivers the payload to viewers. Execution occurs in the site's origin, so scripts inherit access to authenticated session data, WordPress REST endpoints, and administrative UI when a privileged user opens the page.

Root Cause

The defect is a logic error in the CTA save routine within the plugin's call-to-action package. During field processing, the code reads sanitization callbacks from $custom_field_name rather than from $custom_field_options. Because $custom_field_name never contains a callback, the sanitization step is skipped entirely for the vkExUnit_cta_url and vkExUnit_cta_button_text fields. The values are stored as-is and later echoed into rendered HTML without escaping. Relevant source lines are visible in the plugin trac at index.php L259, index.php L271, and class-vk-call-to-action.php L198.

Attack Vector

Exploitation is network-based and requires only low-privileged authentication. A Contributor authors a post containing a CTA block and populates the URL or button text field with an HTML or JavaScript payload. The payload is stored without sanitization. When an editor previews the submission, or when a visitor loads the published page, the script executes in the browser under the site's origin. This creates a scope-changing scenario where a low-privilege user can influence higher-privilege sessions. Technical details are described in the vulnerability disclosure without a published exploitation script; see the Wordfence Vulnerability Report and the fix in WordPress Changeset 3394731.

Detection Methods for CVE-2025-11265

Indicators of Compromise

CTA block content in wp_posts or associated post meta containing <script>, onerror=, onload=, or javascript: sequences within vkExUnit_cta_url or vkExUnit_cta_button_text values.
New or modified Contributor and Author accounts creating posts that include CTA blocks shortly before administrator sessions were used to publish or edit the same content.
Unexpected outbound requests from browsers of editors and administrators to attacker-controlled domains after viewing plugin-managed pages.

Detection Strategies

Query the WordPress database for CTA field values matching HTML event handler patterns or protocol handlers such as javascript:.
Correlate audit logs of post creation by low-privilege users with subsequent access by administrators to identify potential XSS trigger paths.
Deploy web application firewall rules that inspect POST bodies submitted to /wp-admin/post.php and REST endpoints for script tags in CTA parameter names.

Monitoring Recommendations

Enable Content Security Policy reporting and monitor for violations originating from plugin-generated pages.
Alert on installations of the VK All in One Expansion Unit plugin at versions <= 9.112.1.
Track administrator session activity for anomalous REST API calls, user creation events, or plugin installations following visits to CTA-containing pages.

How to Mitigate CVE-2025-11265

Immediate Actions Required

Update the VK All in One Expansion Unit plugin to a version later than 9.112.1 that includes the fix from changeset 3394731.
Audit existing CTA blocks for stored script payloads and remove or sanitize any suspicious content.
Review Contributor and Author accounts, remove unused accounts, and reset credentials for any account that authored suspicious CTA content.

Patch Information

The maintainer addressed the logic error in WordPress Changeset 3394731, which corrects the sanitization callback lookup so that CTA URL and button text values are properly filtered before storage. Administrators should update to the patched release published after version 9.112.1 and verify the plugin version through the WordPress admin interface.

Workarounds

Temporarily deactivate the VK All in One Expansion Unit plugin until the patched version is installed.
Restrict CTA block usage to Editor-level accounts or higher by adjusting role capabilities with a trusted role management plugin.
Deploy a WAF rule that blocks HTML tags and JavaScript event handler patterns in requests targeting vkExUnit_cta_url and vkExUnit_cta_button_text parameters.

bash

# Example WAF pattern (ModSecurity-style) to block script payloads in CTA fields
SecRule ARGS:vkExUnit_cta_url|ARGS:vkExUnit_cta_button_text "@rx (?i)(<script|javascript:|on\w+\s*=)" \
    "id:1011265,phase:2,deny,status:403,log,msg:'CVE-2025-11265 CTA XSS attempt blocked'"