CVE-2026-3348

Vulnerability

The MinhNhut Link Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in its settings fields, including Description, Title, and others. The vulnerability affects all versions up to and including 3.6.1. It stems from insufficient input sanitization and output escaping in the plugin's settings page, as seen in the source code at classes.php [1]. The malicious script is stored and executed when a user accesses the redirect page.

Exploitation

An attacker must be authenticated with Administrator-level privileges or higher. The attack is only possible on multi-site installations or instances where the unfiltered_html capability has been disabled for administrators. The attacker injects arbitrary web scripts into the plugin settings (e.g., the Description or Title fields). When any user visits the redirect page generated by the plugin, the injected script executes in the context of that user's browser.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browsers of users visiting the redirect page. This can lead to session hijacking, defacement, or theft of sensitive information. The attacker can potentially perform actions on behalf of the victim, as the script executes in the context of the affected WordPress site.

Mitigation

The vendor has not yet released a patched version. Users should restrict Administrator access to trusted individuals only, especially on multi-site installations. If possible, enable the unfiltered_html capability for administrators (though this may introduce other risks). As of the publication date, no official fix has been released.