Stored Cross-Site Scripting Vulnerability in Visual Link Preview Plugin for WordPress

CVE-2025-11987

What is CVE-2025-11987?

The Visual Link Preview plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access and above to execute arbitrary web scripts. This occurs through the plugin's visual-link-preview shortcode, which fails to adequately sanitize user inputs and escape outputs. As a result, attackers can inject malicious scripts into pages that will be executed when users access the compromised content. This vulnerability underscores the importance of proper input validation and output escaping in WordPress plugins to protect user data and maintain site integrity.

References