CVE-2023-0937 — VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could le…
Published: 2023-03-20 · CVSS: 6.1 · CVSS 3.1
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7