CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
What the vulnerability does
The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain.
Explanation of Vulnerability in Simple Terms
eLink – Embed Content versions 1.1.0 and earlier contain an input validation flaw that allows authenticated users to modify site content and disrupt service. The vulnerability requires low-level user privileges and network access but no user interaction. Impact extends beyond the vulnerable component itself.
What an attacker can do
Modify site content and cause service disruption.
Potential impact on your site
Authenticated users can alter content and degrade site availability.
Conditions required to exploit
Attacker must have low-level user account; network access required.
Key dates
External resources
Related vulnerabilities
