CVE-2025-7507

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to supply an HTML file that can be leverged to redirect users to a malicious domain.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Aug 15, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-75089.8A vulnerability, which was classified as critical, has been found in code-projects Modern Bag 1.0. Affected by this issue is some unknown fuCVE-2025-75099.8A vulnerability, which was classified as critical, was found in code-projects Modern Bag 1.0. This affects an unknown part of the file /admiCVE-2025-75109.8A vulnerability has been found in code-projects Modern Bag 1.0 and classified as critical. This vulnerability affects unknown code of the fiCVE-2025-75116.5A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the filCVE-2025-75129.8A vulnerability was found in code-projects Modern Bag 1.0. It has been classified as critical. Affected is an unknown function of the file /CVE-2025-75139.8A vulnerability was found in code-projects Modern Bag 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fuCVE-2025-75149.8A vulnerability was found in code-projects Modern Bag 1.0. It has been rated as critical. Affected by this issue is some unknown functionaliCVE-2025-75159.8A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. This affects an unknown part oCVE-2025-75169.8A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. This vulnerability affects unknown CVE-2025-75179.8A vulnerability, which was classified as critical, has been found in code-projects Online Appointment Booking System 1.0. This issue affectsCVE-2025-75184.9The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filenameCVE-2025-75196.7A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered.
CVE-2025-7507: Medium severity, CVSS 6.4 | Vulnix