CVE-2017-18012

Vulnerability

The Z-URL Preview plugin version 1.6.1 for WordPress contains a reflected cross-site scripting (XSS) vulnerability in the url parameter of class.zlinkpreview.php [1]. The plugin fetches a preview of an external URL and reflects the input without proper sanitization, allowing injection of arbitrary HTML and JavaScript. Affected versions include 1.6.1 and possibly earlier releases [2].

Exploitation

An attacker can craft a malicious URL with embedded JavaScript and cause it to be processed by the vulnerable parameter. No authentication is required if the plugin's preview functionality is accessible to unauthenticated users, or the attacker can trick an authenticated user (e.g., an administrator) into clicking a crafted link. The injected script executes in the context of the victim's browser [1].

Impact

Successful exploitation results in cross-site scripting (XSS), enabling the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information such as cookies or credentials, with the privileges of the victim user [1].

Mitigation

The plugin has been closed and removed from the WordPress plugin directory as of June 28, 2019, due to a security issue [3][4]. No patched version was officially released; version 2.0.0 mentioned in the readme added URL validation and XSS checks but was never distributed [2]. Users are advised to uninstall the plugin immediately and seek alternatives. No other workaround is available.