The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscrib…
CVSS 3.1MEDIUM 5.4·Network·Low privileges·No interaction·EPSS 0.00635·Published 2021-09-20·Fixed in 2.2.3CWE-284