CVE-2017-18012

The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.

• CWE-79

• https://packetstormsecurity.com/files/145218/WordPress-Z-URL-Preview-1.6.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.svn.wordpress.org/z-url-preview/trunk/readme.txtRelease Notes, Vendor Advisory
• https://wordpress.org/plugins/z-url-preview/#developersRelease Notes
• https://wordpress.org/support/topic/z-url-preview-1-6-1-cross-site-scripting/Exploit, Issue Tracking, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8990Third Party Advisory
• https://packetstormsecurity.com/files/145218/WordPress-Z-URL-Preview-1.6.1-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.svn.wordpress.org/z-url-preview/trunk/readme.txtRelease Notes, Vendor Advisory
• https://wordpress.org/plugins/z-url-preview/#developersRelease Notes
• https://wordpress.org/support/topic/z-url-preview-1-6-1-cross-site-scripting/Exploit, Issue Tracking, Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8990Third Party Advisory

Published

Jan 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18005Exiv2 0.26 has a Null Pointer Dereference in the Exiv2::Data…5.5
• CVE-2017-18006netpub/server.np in Extensis Portfolio NetPublish has XSS in…
• CVE-2017-18008In ImageMagick 7.0.7-17 Q16, there is a Memory Leak in ReadP…
• CVE-2017-18009In OpenCV 3.3.1, a heap-based buffer over-read exists in the…
• CVE-2017-18010The E-goi Smart Marketing SMS and Newsletters Forms plugin b…
• CVE-2017-18011The MyCBGenie Affiliate Ads for Clickbank Products plugin th…
• CVE-2017-18013In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the…
• CVE-2017-18014An NC-25986 issue was discovered in the Logging subsystem of…
• CVE-2017-18015The ILLID Share This Image plugin before 1.04 for WordPress …
• CVE-2017-18016Parity Browser 1.6.10 and earlier allows remote attackers to…
• CVE-2017-18017The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS…9.8
• CVE-2017-18018In GNU Coreutils through 8.29, chown-core.c in chown and chg…7.1