Element Plus
1 CVEs
product
Monthly
Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Open Redirect
XSS
Element Plus
NVD
GitHub
CVSS 3.1
6.4
EPSS
0.0%
CVE-2025-57665
npm
EPSS 0%
CVSS 6.4
MEDIUM
POC
This Month
Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Open Redirect
XSS
Element Plus
NVD
GitHub