elink – Embed Content WordPress Plugin Malicious Redirect Vulnerability

A vulnerability allowing malicious redirects has been identified in the elink – Embed Content plugin for WordPress, affecting all versions through 1.1.0. The issue arises from insufficient input validation, as the plugin does not restrict the URLs that can be provided through the elink shortcode. This flaw enables authenticated attackers with Contributor-level access or higher to submit an HTML file that can redirect users to a malicious domain.

Impact

Exploitation of this vulnerability could lead to unauthorized redirection of users to malicious websites.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.