{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11987", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-20T19:05:20.737Z", "datePublished": "2025-11-05T09:27:39.799Z", "dateUpdated": "2026-04-08T16:57:52.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:57:52.359Z"}, "affected": [{"vendor": "brechtvds", "product": "Visual Link Preview", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.7", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65ae3119-61d1-4ec0-8ba2-352aae5cc834?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/visual-link-preview/tags/2.2.7/templates/link/simple/simple.php#L1"}, {"url": "https://plugins.trac.wordpress.org/browser/visual-link-preview/tags/2.2.7/includes/public/class-vlp-link.php#L56"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388877/visual-link-preview/trunk/templates/link/simple/simple.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "cweId": "CWE-80", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-20T19:20:42.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T21:24:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T15:43:12.625291Z", "id": "CVE-2025-11987", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:43:22.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11987", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T15:43:12.625291Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:43:18.595Z"}}], "cna": {"title": "Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "brechtvds", "product": "Visual Link Preview", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.2.7"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-20T19:20:42.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T21:24:01.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65ae3119-61d1-4ec0-8ba2-352aae5cc834?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/visual-link-preview/tags/2.2.7/templates/link/simple/simple.php#L1"}, {"url": "https://plugins.trac.wordpress.org/browser/visual-link-preview/tags/2.2.7/includes/public/class-vlp-link.php#L56"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388877/visual-link-preview/trunk/templates/link/simple/simple.php"}], "descriptions": [{"lang": "en", "value": "The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-05T09:27:39.799Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11987", "state": "PUBLISHED", "dateUpdated": "2025-11-05T15:43:22.991Z", "dateReserved": "2025-10-20T19:05:20.737Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T09:27:39.799Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Visual Link Preview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's visual-link-preview shortcode in versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-11987", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-05T10:15:34.637", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/visual-link-preview/tags/2.2.7/includes/public/class-vlp-link.php#L56"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/visual-link-preview/tags/2.2.7/templates/link/simple/simple.php#L1"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3388877/visual-link-preview/trunk/templates/link/simple/simple.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/65ae3119-61d1-4ec0-8ba2-352aae5cc834?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-80"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:03:00.421783+00:00", "value": {"mitigation_remediation": ["Upgrade the Visual Link Preview plugin to the latest version, which removes the vulnerability.", "If an upgrade is not immediately possible, remove or disable the visual\u2011link\u2011preview shortcode from all content or temporarily deactivate the plugin.", "Restrict contributor and higher\u2011level role permissions so that only trusted users can create or edit content that may contain the shortcode."], "summary": {"action": "Update Plugin", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites using the Visual Link Preview plugin developed by BrechtVds, specifically versions up to and including 2.2.7, are affected. Sites that have enabled the visual\u2011link\u2011preview shortcode and grant contributor or higher permissions to content editors are at risk.", "description_and_impact": "The Visual Link Preview plugin for WordPress is vulnerable to stored cross\u2011site scripting because the shortcode attributes are not properly sanitized or escaped. An authenticated attacker with contributor\u2011level access can embed arbitrary JavaScript into the attribute values, resulting in script execution whenever a page containing the malicious shortcode is viewed by any user.", "risk_and_exploitability": "With a CVSS score of 6.4 the vulnerability presents moderate severity and an EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires a user authenticated with contributor or higher, allowing the injection of malicious scripts that will run in the browsers of any visitor who loads the affected page."}}}}, "created": "2025-11-06T10:07:26.144184+00:00", "updated": "2026-04-22T12:15:16.043267+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}