LinkedInclude
LinkedInclude has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for LinkedInclude has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. LinkedInclude is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.7.17.
CVE-2025-57918LinkedInclude <= 3.0.4 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
LinkedInclude
Author
ERA404
This plugin operates by scraping an Author Post Activity page (e.g.: https://www.linkedin.com/today/author/[author]) to collect information about the author(s)’ LinkedIn articles. The properties of these articles are then sanitized and saved to a new table in WordPress, preparing them for output into your widget. The widget can be positioned in sidebars or footers like any other feed. Boost the Traffic to your LinkedIn Articles Industry Leaders using LinkedIn for their social or news broadcasts can direct their blog traffic back to LinkedIn. Plugin can import LinkedIn articles from any number of authors. Separate widgets can be placed into the templates to show articles by one author, or all author articles sorted by newest. Additional widget controls built in for number of articles, module title and excerpt length. Imported articles can be individually toggled for visibility.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C