The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wordpress |
|
No data.
No data.
References
History
Sat, 16 Aug 2025 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Wordpress
Wordpress wordpress |
|
| Vendors & Products |
Wordpress
Wordpress wordpress |
Fri, 15 Aug 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 15 Aug 2025 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain. | |
| Title | elink – Embed Content <= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validation | |
| Weaknesses | CWE-20 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2025-08-15T16:09:44.837Z
Reserved: 2025-07-11T20:42:31.722Z
Link: CVE-2025-7507
Vulnrichment
Updated: 2025-08-15T16:09:40.397Z
NVD
Status : Awaiting Analysis
Published: 2025-08-15T09:15:27.603
Modified: 2025-08-15T13:12:51.217
Link: CVE-2025-7507
Redhat
No data.