Most recent entries from all

EUVD-2026-211101

fkie_cve-2023-28367

Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.

GHSA-mqcm-5978-hg9g

Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated attacker to inject an arbitrary script.

gsd-2023-28367

jvndb-2023-000045

WordPress Plugin "VK Blocks" and "VK All in One Expansion Unit" provided by Vektor,Inc. contain multiple cross-site scripting vulnerabilities (CWE-79) listed below.<ul><li>Cross-site scripting vulnerability in Tag edit function - CVE-2023-27923</li><li>Cross-site scripting vulnerability in Post function - CVE-2023-27925</li><li>Cross-site scripting vulnerability in Profile setting function - CVE-2023-27926</li><li>Cross-site scripting vulnerability in CTA post function - CVE-2023-28367</li></ul>apple502j reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.