CVE-2023-0937

🗓️ 20 Mar 2023 15:52:18Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 65 Views🌐 WEB

The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 is prone to Reflected XSS via an unescaped REQUEST_URI parameter

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-0937	20 Mar 202321:04	–	circl
CNNVD	WordPress Plugin VK All in One Expansion Unit 跨站脚本漏洞	20 Mar 202300:00	–	cnnvd
Cvelist	CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS	20 Mar 202315:52	–	cvelist
EUVD	EUVD-2023-12923	3 Oct 202520:07	–	euvd
NVD	CVE-2023-0937	20 Mar 202316:15	–	nvd
OpenVAS	WordPress VK All in One Expansion Unit Plugin < 9.87.1.0 XSS Vulnerability	16 Oct 202300:00	–	openvas
Prion	Cross site scripting	20 Mar 202316:15	–	prion
Positive Technologies	PT-2023-16624 · WordPress · Vk All In One Expansion Unit	20 Mar 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-0937	23 May 202502:57	–	redhatcve
Vulnrichment	CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS	20 Mar 202315:52	–	vulnrichment

NVD

Vulners

Node

vektor-inc vk_all_in_one_expansion_unitRange<9.87.1.0wordpress

[
  {
    "vendor": "Unknown",
    "product": "VK All in One Expansion Unit",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "9.87.1.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/5110ff02-c721-43eb-b13e-50aca25e1162

Parameter	Position	Path	Description	CWE
b	query param	/wp-admin/admin.php?page=vkExUnit_css_customize&b="><svg/onload=alert(/XSS/)>	Reflected XSS via unsafely echoed REQUEST_URI parameter in attribute	CWE-79

25 Feb 2025 22:15Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.1

EPSS0.00326

SSVC

cve-2023-0937 vk all in one expansion unit wordpress plugin xss reflected xss security vulnerability nvd