The Visual Link Preview plugin for WordPress suffers from a stored XSS vulnerability (CWE-80) in versions up to and including 2.2.7. This vulnerability is due to inadequate sanitization and escaping of user input in the visual-link-preview shortcode attributes. Authenticated attackers with contributor or higher privileges can inject arbitrary scripts that execute in the context of users viewing the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, and partial impact on confidentiality and integrity with no impact on availability. No patch or official remediation guidance is currently documented.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages using the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to partial confidentiality and integrity compromise such as session token theft or unauthorized actions performed on behalf of users. There is no reported impact on system availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Visual Link Preview plugin to prevent exploitation.