Skip to content
PluginCanary

VK All in One Expansion Unit

by Hidekazu Ishikawa · 100,000+ active installs · Checked 5 Nov 2026
Healthy

Healthy: maintained, last release 4 Nov 2026, 92 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for VK All in One Expansion Unit
Ownership100
Maintenance100
Security75
SupportNo data
Reputation60

How the score works

Quick answers

Is VK All in One Expansion Unit still maintained?
Yes. Last release 4 Nov 2026, 92 releases in the last 24 months. 4 Nov 2026 · wordpress.org
Who owns VK All in One Expansion Unit, and has it changed hands?
No change recorded. Main committer kurudrive since Jun 2015. 5 Nov 2026 · SVN log
Was VK All in One Expansion Unit removed from wordpress.org?
No. Listed on wordpress.org as of 5 Nov 2026. 5 Nov 2026 · wordpress.org
Is VK All in One Expansion Unit safe?
12 known vulnerabilities, all fixed (latest in 9.119.0). Not on the exploited list. 17 Sep 2026 · Wordfence Intelligence
Is the latest VK All in One Expansion Unit update safe to install?
No ownership change before 9.124.0. No one-star spike after it. 4 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • InfoMOM-2Downloads in the last 4 weeks are down more than half vs the 26-week average. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
kurudrive30 Jun 2015 to 4 Nov 2026, 1035 commits

1 committer recorded. No ownership change since 2015.

Maintenance

Last release
today
Releases, 24 months
92
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for VK All in One Expansion Unit
Q1 20248
Q2 20247
Q3 202410
Q4 202418
Q1 202518
Q2 202513
Q3 20258
Q4 20258
Q1 202610
Q2 202610
Q3 20269
Q4 20261

Last release 4 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.0.

Rating distribution
5 star5
4 star0
3 star0
2 star1
1 star1
Latest low reviews

Security record

5 vulnerabilities in 24 months (12 on record), all patched (latest fixed in 9.119.0).

Show 12 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
17 Sep 2026VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta6.4<= 9.118.09.119.0Patched before disclosure
23 Mar 2026VK All in One Expansion Unit <= 9.113.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 9.113.39.113.4n/a
17 Feb 2026VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title6.4<= 9.112.39.112.4n/a
17 Nov 2025VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 9.112.19.112.2n/a
17 Nov 2025VK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 9.112.19.112.2n/a
10 Jul 2024VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 9.99.1.09.99.2.022
26 Mar 2024VK All in One Expansion Unit <= 9.95.0.1 - Information Exposure6.5<= 9.95.0.19.96.0.0Patched before disclosure
25 Mar 2024VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className6.4<= 9.96.0.19.97.0.0Patched before disclosure
9 May 2023VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in CTA Post6.4<= 9.88.1.09.88.2.0Patched before disclosure
9 May 2023VK All in One Expansion Unit <= 9.88.1.0 - Stored (Contributor+) Cross-Site Scripting in Profile Setting6.4<= 9.88.1.09.88.2.0Patched before disclosure
22 Feb 2023VK All in One Expansion Unit <= 9.87.0.1 - Reflected Cross-Site Scripting via REQUEST_URI4.7<= 9.87.0.19.87.1.0Patched before disclosure
3 Feb 2023VK All in One Expansion Unit <= 9.85.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 9.85.0.19.86.0.0Patched before disclosure

Changelog mentions of security fixes: 9.115.1 (security); 9.116.0 (security, escaping, sanitize); 9.118.0 (security, escaping); 9.119.0 (security, XSS, escaping); 9.122.0 (security, escaping).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

100,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for VK All in One Expansion Unit
4 May 20263,673
11 May 202663,196
18 May 202665,808
25 May 2026118,388
1 Jun 202666,261
8 Jun 20267,786
15 Jun 202659,900
22 Jun 2026121,435
29 Jun 202664,355
6 Jul 20269,636
13 Jul 20266,052
20 Jul 20266,217
27 Jul 202660,319
3 Aug 202616,858
10 Aug 2026117,931
17 Aug 2026123,208
24 Aug 202669,061
31 Aug 202664,301
7 Sep 202611,243
14 Sep 20266,898
21 Sep 20266,284
28 Sep 20265,613
5 Oct 20264,758
12 Oct 20263,399
19 Oct 202614,616
26 Oct 20265,700
2 Nov 2026801

Weekly downloads over the last 4 weeks are 85% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Catch Web ToolsScore 93 · 10,000+Nexter ExtensionScore 91 · 10,000+

Facts

Version9.124.0
AuthorHidekazu Ishikawa
Added30 Jun 2015
Last updated4 Nov 2026
Active installs100,000+
Requires WordPress6.5
Tested up to7.1.4
Requires PHP7.4
CategorySite Administration & Utilities > Site Migration & Cloning
Tagsog tags, sitemap, related posts, google analytics, facebook page plugin

Other plugins by this author: VK Post Author Display, Lightning Advanced Unit

Questions

Is VK All in One Expansion Unit still maintained?

Yes. Last release 4 Nov 2026, 92 releases in the last 24 months.

Who owns VK All in One Expansion Unit, and has it changed hands?

No change recorded. Main committer kurudrive since Jun 2015.

Was VK All in One Expansion Unit removed from wordpress.org?

No. Listed on wordpress.org as of 5 Nov 2026.

Is VK All in One Expansion Unit safe?

12 known vulnerabilities, all fixed (latest in 9.119.0). Not on the exploited list.

Is the latest VK All in One Expansion Unit update safe to install?

No ownership change before 9.124.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 5 Nov 2026.Report a data issue