Visual Link Preview

Visual Link Preview has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 6 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.4 out of 10. 2026 was the busiest year with 4 disclosures.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 2 of the records (33%). Other recurring categories include Improper Access Control, Improper Neutralization Of Script-Related HTML Tags In A Web Page (Basic XSS).

Every one of the 6 issues recorded for Visual Link Preview has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, one record each. Visual Link Preview is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

5.2/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Visual Link Preview vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-39670

Visual Link Preview <= 2.3.0 - Authenticated (Contributor+) Server-Side Request Forgery

Read the full analysis

Vulnerability Records

6 records


2026-06-17 00:00	Visual Link Preview <= 2.3.1 - Authenticated (Subscriber+) Sensitive Information Exposure Visual Link Preview <= 2.3.1	`CVE-2026-54821`	4.3 Medium	she11f	Yes
2026-06-02 00:00	Visual Link Preview <= 2.4.1 - Authenticated (Subscriber+) Information Exposure Visual Link Preview <= 2.4.1	`CVE-2026-48878`	4.3 Medium	Aliefis	Yes
2026-02-19 00:00	Visual Link Preview <= 2.3.0 - Authenticated (Contributor+) Server-Side Request Forgery Visual Link Preview <= 2.3.0	`CVE-2026-39670`	6.4 Medium	Nguyen Ba Khanh	Yes
2026-01-18 00:00	Visual Link Preview <= 2.2.9 - Missing Authorization Visual Link Preview <= 2.2.9	`CVE-2026-24984`	4.3 Medium	theviper17	Yes
2025-11-04 21:24	Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode Visual Link Preview <= 2.2.7	`CVE-2025-11987`	6.4 Medium	Rafshanzani Suhada	Yes
2021-08-18 00:00	Visual Link Preview <= 2.2.2 - Unauthorised AJAX Calls Visual Link Preview < 2.2.3	`CVE-2021-24635`	5.4 Medium	apple502j	Yes

Showing 1–6 of 6 reports

Latestv2.4.2

Visual Link Preview

Author

Brecht

4.5(36)

90/100

Last Updated

2026-08-19 (25d ago)

Active Installs

10,000+

Downloads

193,948

Requires WP

4.4+

Requires PHP

Tested up to

WP 7.1

Created

2017-05-15 (10y ago)

Easily create a Facebook-like link preview for any link on your website. You can choose the image and text to display and create your very own custom template. The default template can be styled from the settings to match your website. Some examples of what you could use this for: A call to action for your affiliate links Promote WooCommerce products on your website List sources for your article A weekly posty of interesting websites you’ve found Link to related posts on your own website … It does not require any database lookups, which means even having many of these blocks on a page should not affect performance. Compatible with both the Classic and Gutenberg Block Editor using shortcodes and blocks. Also includes full Elementor support with a dedicated widget for easy integration into your Elementor pages. The plugin includes multiple URL metadata providers (PHP, Microlink API, and LinkPreview API) with automatic fallback switching. If one provider fails to fetch link information, the plugin automatically tries the next available provider. You can also manually retry with a different provider if needed. Need help? Check out our documentation! This plugin is in active development. Feel free to contact us with any feature requests or ideas.

View on WordPress.org