CVE-2025-7507 describes a vulnerability in the elink – Embed Content WordPress plugin where the plugin fails to restrict URLs supplied through its elink shortcode. Authenticated attackers with Contributor-level or higher permissions can supply crafted HTML files that cause user redirection to malicious domains. This is due to improper input validation (CWE-20). The vulnerability affects all versions up to 1.1.0. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or remediation is currently available from the vendor.

An attacker with Contributor-level or higher access can exploit this vulnerability to redirect users to malicious domains by supplying crafted URLs via the elink shortcode. This could lead to phishing, malware distribution, or other malicious activities facilitated by the redirect. The integrity and availability impacts are limited but the scope is changed, meaning the vulnerability affects resources beyond the initial component. There is no direct confidentiality impact reported. No known exploits are currently documented in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or removing the elink – Embed Content plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.