Skip to content
OpenAdvisories

Vendor

Vektor

18 known vulnerabilities.

Vektor at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 1 vulnerability Dec 2025 January 2026: 1 vulnerability February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 2 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202620
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202610
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202510
Feb 202500
Jan 202500
Dec 202400

Products

VK Blocks 5 VK All in One Expansion Unit 4 VK Google Job Posting Manager 3 VK Blocks and VK Blocks Pro 2 VK Filter Search 2 VK Block Patterns 2
All Critical High Medium Low Exploited only Public exploit

18 results · Feed

  • Medium 6.4
    CVE-2026-78087

    VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature

    The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    Vektor VK Blocks Web / CMS
  • High 8.8
    CVE-2026-100511

    WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.

    Vektor VK Google Job Posting Manager
  • Medium 6.4
    CVE-2025-12836

    VK Google Job Posting Manager <= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field

    The VK Google Job Posting Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Job Description field in versions up to, and including, 1.2.23 due to insufficient input sanitization and output escaping on user-supplied attributes. …

    Vektor VK Google Job Posting Manager Web / CMS
  • Medium 6.5
    CVE-2025-68070

    WordPress VK Google Job Posting Manager plugin <= 1.2.22 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Stored XSS.This issue affects VK Google Job Posting Manager: from n/a through …

    Vektor VK Google Job Posting Manager
  • Medium 6.5
    CVE-2025-32175

    WordPress VK Filter Search plugin <= 2.20.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Filter Search vk-filter-search allows Stored XSS.This issue affects VK Filter Search: from n/a through <= 2.20.2.

    Vektor VK Filter Search
  • Medium 4.3
    CVE-2024-13635

    VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure

    The VK Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.94.2.2 via the page content block. This makes it possible for authenticated attackers, with Contributor-level access and above, to extra…

    Vektor VK Blocks Web / CMS
  • Medium 4.8
    CVE-2024-52268

    Cross-site scripting vulnerability exists in VK All in One Expansion Unit versions prior to 9.100.1.0. If this vulnerab…

    Vektor VK All in One Expansion Unit
  • Medium 6.5
    CVE-2024-37956

    WordPress VK All in One Expansion Unit plugin <= 9.99.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vektor,Inc. VK All in One Expansion Unit allows Stored XSS.This issue affects VK All in One Expansion Unit: from n/a through 9.99.1.0.

    Vektor VK All in One Expansion Unit
  • Medium 5.3
    CVE-2024-32826

    WordPress VK Block Patterns plugin <= 1.31.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0.

    Vektor VK Block Patterns
  • Medium 4.3
    CVE-2024-0623 Public exploit

    VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery

    The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for …

    Vektor VK Block Patterns Web / CMS
  • Medium 6.4
    CVE-2023-5706

    VK Blocks <= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block

    The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, and including, 1.63.0.1 due to insufficient input sanitization and output escaping on user supplied at…

    Vektor VK Blocks Web / CMS
  • Medium 6.4
    CVE-2023-5705

    VK Filter Search <= 2.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and including, 2.3.1 due to insufficient input sanitization and output escaping on user supplied attrib…

    Vektor VK Filter Search Web / CMS
  • Medium 4.3
    CVE-2023-0584

    VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

    The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change the 'vk_f…

    Vektor VK Blocks Web / CMS
  • Medium 4.3
    CVE-2023-0583

    VK Blocks <= 1.57.0.5 - Authenticated(Contributor+) Settings Update

    The VK Blocks plugin for WordPress is vulnerable to improper authorization via the REST 'update_vk_blocks_options' function in versions up to, and including, 1.57.0.5. This allows authenticated attackers, with contributor-level permissions or above, to change…

    Vektor VK Blocks Web / CMS
  • Medium 5.4
    CVE-2023-28367

    Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a r…

    Vektor VK All in One Expansion Unit
  • Medium 5.4
    CVE-2023-27925

    Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and ea…

    Vektor VK Blocks and VK Blocks Pro
  • Medium 5.4
    CVE-2023-27926

    Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier all…

    Vektor VK All in One Expansion Unit
  • Medium 5.4
    CVE-2023-27923

    Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 an…

    Vektor VK Blocks and VK Blocks Pro