The elink – Embed Content plugin for WordPress fails to restrict URLs that can be passed through its shortcode, allowing an authenticated user with Contributor level or higher to supply an HTML file that forces a redirect to an attacker‑controlled domain. This flaw is a classic example of insufficient input validation (CWE‑20). The principal impact is that users who view content using the shortcode will be sent to malicious sites, potentially facilitating phishing or malware infection.

The vulnerability affects the WordPress plugin elink – Embed Content, with all releases up to and including version 1.1.0. Site administrators should confirm which version they are running and plan to upgrade or remove the plugin if they are on a vulnerable release.

The CVSS score of 6.4 denotes medium severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation. The attack requires authenticated access with at least Contributor privileges, so the exploit cannot be launched by unauthenticated actors. Although the vulnerability is not listed in the CISA KEV catalog, the lack of input validation permits attackers to redirect site visitors, creating a significant risk to user trust and potential for credential compromise.