CVE-2017-18012
The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.
Date published : 2018-01-01
https://packetstormsecurity.com/files/145218/WordPress-Z-URL-Preview-1.6.1-Cross-Site-Scripting.html
https://plugins.svn.wordpress.org/z-url-preview/trunk/readme.txt