CVE-2026-3349

Vulnerability

The MinhNhut Link Gateway plugin for WordPress (all versions up to and including 3.6.1) contains a reflected cross-site scripting vulnerability in the redirect page. The url parameter is insufficiently sanitized and escaped before output, allowing injection of arbitrary web scripts. The vulnerable code is in classes.php at line 263 [1].

Exploitation

An unauthenticated attacker can craft a malicious link containing a JavaScript payload in the url parameter. The victim must be tricked into clicking the link (e.g., via phishing). No authentication or special privileges are required. The script executes in the context of the victim's browser on the WordPress site.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites. The impact is limited to the victim's session and browser, but can be used to steal cookies or perform actions on behalf of the victim.

Mitigation

As of the publication date (2026-05-27), no fixed version has been released. Users should disable the plugin or apply input validation and output escaping to the url parameter. The vendor has not provided a patch. The plugin may be considered for removal if no update is forthcoming.