Input validation vulnerability in VK All in One Expansion Unit 9.112.1

The plugin called VK All in One Expansion Unit for WordPress can be hacked through the ‘_veu_custom_css’ section. This happens in versions 9.112.1 and below because the plugin does not properly filter out harmful code from user-inputted Custom CSS. This means that people with Contributor-level access or higher can insert harmful scripts into pages that will run whenever someone visits that page.