VK Expansion Unit CVE-2026-17586

Requires an authenticated WordPress account with contributor-level capability or higher on a site running VK All in One Expansion Unit ≤9.118.0, and use of the plugin's Call-To-Action feature where the 'vkExUnit_cta_img_position' post meta is rendered. The payload must use a double-quote and an on* event-handler attribute to slip past the sanitize_text_field save callback and the Vk_Call_To_Action::safe_kses_post() output filter (which only rewrites disallowed iframe elements). Limiting factors: exploitation is gated on the PR:L contributor privilege (most impactful on multi-author sites or those allowing open/untrusted registration), and payload execution requires a victim - a visitor or administrator - to subsequently view the injected page (stored, so no attacker-side UI trickery needed but a viewing victim is required for impact).

This is an authenticated, contributor-level stored XSS with a moderate CVSS 3.1 base of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). The network vector, low complexity and no-user-interaction flags are offset by the PR:L requirement - an attacker must already hold a contributor or higher account, which meaningfully narrows the realistic attacker population to sites that permit untrusted user registration or have multiple content authors. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so all three exploitation-likelihood signals are absent or negative; this is a patch-and-schedule item rather than an emergency. The scope change (S:C) and the code-level detail in the references (the sanitize_text_field callback not stripping double-quotes or on* handlers, and safe_kses_post() passing non-iframe content verbatim) are credible and specific, but they describe a mechanism, not observed exploitation. Net: a real, verifiable defect worth remediating, not a high-urgency mass-exploitation risk. Wordfence is the sole reporter/source, so the assessment rests on a single vendor's analysis, albeit one corroborated by directly-linked plugin source lines.

An attacker holding a contributor account on a WordPress site running VK All in One Expansion Unit (≤9.118.0) crafts a Call-To-Action block and injects a payload with a double-quote and an on* event handler into the 'vkExUnit_cta_img_position' post meta, which survives the sanitize_text_field save filter and the safe_kses_post() output filter. When any visitor or an administrator later views the page, the script executes in their browser, enabling session/cookie theft or admin-context actions. No public proof-of-concept is identified at time of analysis.