Cross-Site Scripting
10 records90.9%First: 2023. Latest: 2026.
Plugin security history
VK All in One Expansion Unit Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 11 vulnerability records associated with VK All in One Expansion Unit, published between 2023 and 2026.
Dataset last synchronized: 2026-08-03 00:31:25 UTC
At a glance
Security Snapshot
11Total records
0Critical
0High
11Medium
0Low
0Informational
11Patched records
0Currently marked unpatched
2023-02-03First disclosure
2026-03-23Latest disclosure
11 of 11CVE coverage
Use this history
Check and watch VK All in One Expansion Unit.
A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2023 | 4 | |
| 2024 | 3 | |
| 2025 | 2 | |
| 2026 | 2 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Medium | 11 | 100% |
Vulnerability-Type Breakdown
Information Disclosure
1 record9.1%First: 2024. Latest: 2024.
Patch Status
- Patched
- 11
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
9.113.49.112.49.112.29.99.2.09.96.0.09.97.0.09.88.2.09.87.1.09.86.0.0
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
*-9.113.3 | VK All in One Expansion Unit <= 9.113.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | March 23, 2026 | 9.113.4 | Medium |
*-9.112.3 | VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title | February 17, 2026 | 9.112.4 | Medium |
*-9.112.1 | VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | November 17, 2025 | 9.112.2 | Medium |
*-9.112.1 | VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | November 17, 2025 | 9.112.2 | Medium |
*-9.99.1.0 | VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | July 10, 2024 | 9.99.2.0 | Medium |
*-9.95.0.1 | VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure | March 26, 2024 | 9.96.0.0 | Medium |
*-9.96.0.1 | VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className | March 25, 2024 | 9.97.0.0 | Medium |
*-9.88.1.0 | VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting | May 9, 2023 | 9.88.2.0 | Medium |
*-9.88.1.0 | VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post | May 9, 2023 | 9.88.2.0 | Medium |
*-9.87.0.1 | VK All in One Expansion Unit <= 9.87.0.1 - Reflected Cross-Site Scripting via REQUEST_URI | February 22, 2023 | 9.87.1.0 | Medium |
*-9.85.0.1 | VK All in One Expansion Unit <= 9.85.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | February 3, 2023 | 9.86.0.0 | Medium |
Selected source records
Latest Records
MediumCVE-2026-39483
VK All in One Expansion Unit <= 9.113.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: March 23, 2026
- Affected versions
- *-9.113.3
- Patched versions
- 9.113.4
MediumCVE-2025-11737
VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
Published: February 17, 2026
- Affected versions
- *-9.112.3
- Patched versions
- 9.112.4
MediumCVE-2025-11267
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: November 17, 2025
- Affected versions
- *-9.112.1
- Patched versions
- 9.112.2
MediumCVE-2025-11265
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: November 17, 2025
- Affected versions
- *-9.112.1
- Patched versions
- 9.112.2
MediumCVE-2024-37956
VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: July 10, 2024
- Affected versions
- *-9.99.1.0
- Patched versions
- 9.99.2.0
MediumCVE-2024-2093
VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure
Published: March 26, 2024
- Affected versions
- *-9.95.0.1
- Patched versions
- 9.96.0.0
MediumCVE-2024-2170
VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className
Published: March 25, 2024
- Affected versions
- *-9.96.0.1
- Patched versions
- 9.97.0.0
MediumCVE-2023-28367
VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post
Published: May 9, 2023
- Affected versions
- *-9.88.1.0
- Patched versions
- 9.88.2.0
Highest-Severity Records
MediumCVE-2024-2093
VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure
Published: March 26, 2024
- Affected versions
- *-9.95.0.1
- Patched versions
- 9.96.0.0
MediumCVE-2024-2170
VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className
Published: March 25, 2024
- Affected versions
- *-9.96.0.1
- Patched versions
- 9.97.0.0
MediumCVE-2023-28367
VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post
Published: May 9, 2023
- Affected versions
- *-9.88.1.0
- Patched versions
- 9.88.2.0
MediumCVE-2025-11737
VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
Published: February 17, 2026
- Affected versions
- *-9.112.3
- Patched versions
- 9.112.4
MediumCVE-2023-27926
VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting
Published: May 9, 2023
- Affected versions
- *-9.88.1.0
- Patched versions
- 9.88.2.0
MediumCVE-2025-11267
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: November 17, 2025
- Affected versions
- *-9.112.1
- Patched versions
- 9.112.2
MediumCVE-2025-11265
VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: November 17, 2025
- Affected versions
- *-9.112.1
- Patched versions
- 9.112.2
MediumCVE-2024-37956
VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published: July 10, 2024
- Affected versions
- *-9.99.1.0
- Patched versions
- 9.99.2.0
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.