CVE-2025-7507

MEDIUM

6.4

Beschreibung

The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain.

CVE Details

CVSS v3.1 Bewertung6.4

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht8/15/2025

Zuletzt geandert8/15/2025

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-20

Referenzen

https://wordpress.org/plugins/elink-embed-content/(security@wordfence.com)

https://www.wordfence.com/threat-intel/vulnerabilities/id/bda249f7-07a9-47ba-bba4-85abd8f8a207?source=cve(security@wordfence.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.