The Beautiful Link Preview plugin implements unsanitized user input into the output web page, enabling a stored cross‑site scripting (XSS) attack. An attacker can inject malicious scripts that will execute in the browsers of any user who views the affected website, enabling theft of session data, user credentials, or arbitrary malicious actions in the victim’s context. The flaw is a classic CWE‑79 vulnerability.

This weakness affects WordPress installations running the zeitwesentech Beautiful Link Preview plugin versions up to and including 1.5.0. Users who have not upgraded past this version are potentially vulnerable.

The CVSS score of 5.9 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is unlikely at present. The flaw is not listed in CISA’s KEV catalog. Attackers would need to persuade a user to access a page that includes the injected script, which could be achieved via social engineering or by encouraging users to visit infected links. No special privileges are required beyond the ability to submit content that the plugin stores.