CVE-2025-11267: WordPress VK Expansion Unit XSS Vulnerability

CVE-2025-11267 is a stored cross-site scripting vulnerability in the VK All in One Expansion Unit plugin for WordPress. Attackers with Contributor-level access can inject malicious scripts. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2025-11267 Overview

CVE-2025-11267 is a stored Cross-Site Scripting (XSS) vulnerability in the VK All in One Expansion Unit plugin for WordPress. The flaw affects all versions up to and including 9.112.1. It stems from insufficient input sanitization and output escaping on the _veu_custom_css parameter, which accepts user-supplied Custom CSS. Authenticated users with Contributor-level access or higher can inject arbitrary web scripts. Injected payloads execute in the browsers of any user who views an affected page. The issue is tracked under CWE-80: Improper Neutralization of Script-Related HTML Tags.

Critical Impact
Contributor-level attackers can persist JavaScript that runs against site visitors and administrators, enabling session theft, forced actions, and further site compromise.

Affected Products

VK All in One Expansion Unit plugin for WordPress
All plugin versions up to and including 9.112.1
WordPress sites that permit Contributor or higher roles to publish content

Discovery Timeline

2025-11-18 - CVE-2025-11267 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-11267

Vulnerability Analysis

The VK All in One Expansion Unit plugin exposes a Custom CSS field managed through the _veu_custom_css post metabox. Content submitted to this field is stored in post metadata and later rendered into pages by the CSS customization loader. The plugin fails to sanitize the value on input and does not escape it on output. As a result, an attacker can break out of the intended CSS context and inject <script> tags or other executable markup. When a visitor loads a page carrying the injected content, the payload executes with the visitor's privileges on the site origin. Administrator sessions are a high-value target for this class of flaw.

Root Cause

The root cause is missing neutralization of script-capable HTML around the _veu_custom_css metabox handler in admin/class-veu-metabox.php and the corresponding output path in inc/css-customize/css-customize-single.php. The plugin trusts authenticated author input and writes it back into the page without contextual escaping.

Attack Vector

An authenticated Contributor creates or edits a post and populates the Custom CSS field with a payload that closes the CSS context and appends script markup. The malicious content is stored in post meta. When a reviewer, editor, or administrator previews the post, or when the content is later published, any visitor rendering the page triggers execution of the injected script in their browser session.

See the WordPress Plugin Code Reference and the WordPress CSS Customization Code for the vulnerable code paths.

Detection Methods for CVE-2025-11267

Indicators of Compromise

Post meta records containing _veu_custom_css values with <script>, </style>, onerror=, or javascript: substrings
Unexpected outbound requests from site visitor browsers to attacker-controlled domains referenced from post pages
New or modified administrator accounts following Contributor activity on the plugin
Session cookies or nonce values appearing in web server referrer logs to third-party hosts

Detection Strategies

Query the wp_postmeta table for the _veu_custom_css key and inspect stored values for HTML or script content that is not valid CSS
Review WordPress audit logs for post edits by Contributor accounts targeting posts that expose the Custom CSS metabox
Scan rendered pages with a headless browser and alert on script tags injected via plugin-managed metadata

Monitoring Recommendations

Monitor role changes, user creation, and password resets initiated from admin sessions that recently viewed Contributor-authored posts
Alert on Content Security Policy (CSP) violation reports originating from plugin-rendered pages
Track plugin version inventory across all WordPress hosts and flag any installations at or below 9.112.1

How to Mitigate CVE-2025-11267

Immediate Actions Required

Update the VK All in One Expansion Unit plugin to a version newer than 9.112.1 on every WordPress site
Audit all posts and post meta for previously injected _veu_custom_css payloads and remove malicious content
Rotate administrator credentials and invalidate active sessions if injected content was rendered to privileged users
Review and restrict Contributor-level accounts that are not required for site operations

Patch Information

The vendor addressed the vulnerability in the release that follows 9.112.1. Review the fix in the WordPress Plugin Changeset and the Wordfence Vulnerability Report for advisory details.

Workarounds

Temporarily disable the VK All in One Expansion Unit plugin until patched
Deploy a Web Application Firewall (WAF) rule that strips HTML tags from requests writing to the _veu_custom_css field
Enforce a strict Content Security Policy that disallows inline scripts on WordPress front-end pages
Remove the Contributor role from users who do not need publishing capabilities, reducing the pool of accounts able to reach the vulnerable metabox

bash

# Content Security Policy example to limit inline script execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'; base-uri 'self'; report-uri /csp-report"